October 2014 - dovecot

Re: dictionary attack defense
by Joseph Tam 23 Oct '14

23 Oct '14

Cliff Hayes writes: > a) I read about auth_failure_delay even before I posted my question and > I could not figure out the one-line explanation in the dovecot wiki: > "Number of seconds to delay before replying to failed authentications." > It's delaying a reply. Does that mean the hacker can keep asking as > fast as he wants? As Reindl states, authentication is a synchronous operation so the BFD attacker must wait for a reply before continuing. An attacker can get around this by running a botnet against you or opening up many concurrent connections (I think the latter can be capped), but I've rarely seen this. A botnet attack will defeat IP based blocking anyways. > Is it per user or per IP? Irrelevant -- there is no tracking. It's simply pauses the reply to bad auth attempts and tarpits the session. auth_failure_delay does not block BFD attacks, but makes it infeasable for reasonable strength passwords. It's simpler to implement, robust, and fault tolerant (e.g. a user cannot accidentally lock themselves out requiring administrative intervention to restore immediate access, or repeated failures from a NAT'd network does not DoS everything within the NAT'd network). Joseph Tam <jtam.home(a)gmail.com>

1 0

How to configure read-only access during a migration?
by Jeffrey Tunison 22 Oct '14

22 Oct '14

Hi. I would appreciate your advice about this PROBLEM: ======================================================= Find the simplest way to configure a Dovecot 2.2.10 IMAP server to access existing email users' (mbox-format) mail folders via a master_user ****in read-only mode.**** (I've got the master_user access working.) Simplest because while I'm proficient at UNIX systems administration, I'm under time pressure and dovecot has a lot of configuration flexibility. Identifying the right way to do this is proving time- consuming. Namespaces? ACL's? Passdb's? Mounting the mail-containing file systems in read-only mode did not work. (Would it have worked if I had disabled all file-locking rules (if so, how?)?) I thought it was time to bring in the dovecot wizards. You! GOAL: ======================================================= Without knowing or changing users' passwords, migrate several hundred users of dovecot IMAP to MS Exchange using the commercial product Transend. I'm manging the dovecot side, someone else is doing the Transend/Exchange piece. Migration would occur in batches due to slowness of the Transend side when dealing with users with email collections over a few gigabytes. I have a production IMAP server (dovecot 1.0.13 on 32-bit RHEL 4.9). Let's call it PROD for short. Users INBOXes are stored locally on PROD. Their other mail folders are stored on a second machine and accessed via NFS. Those other folders contain the great majority of the email to be migrated. Let's call the NFS server MIGR for short. On MIGR, I've set up a migration IMAP server (dovecot 2.2.10 on 64-bit RHEL 5.10). MIGR is a dedicated NFS server with newer hardware than PROD. It has an unused Ethernet NIC I can tell Transend to use. Both PROD and MIGR use NIS for authentication. Therefore PAM is consulted for passdb information, normally. No SQL db's used. I set up the second server (MIGR) for several reasons: 1) there are some users mail folders larger than the 32-bit file size limit found on the PROD server. 2) the bulk of the email is stored locally on the MIGR server. 3) the version of dovecot is much newer and therefore more likely to have fewer bugs and more configuration options. 4) I don't want to modify the production environment except where really necessary. Pointing Transend at MIGR instead of PROD seems like it will be faster and better. Telling end-users to use MIGR instead of PROD would allow them to verify that their email came across okay (into MS Exchange) without being able to modify the original copy of email (in Dovecot). In the days and weeks after migration. I'd like to disable access ***for a batch of users*** on the PROD server at the time the migration begins for that batch. I may need to re-enable access on PROD for certain users if the migration does not succeed. Transend has been dying on a number of test users despite tweaking its parameters in consultation with the vendor. "Corrupt" messages seem to be the issue. Users (or sysadmins) might be required to identify and delete the offending messages before we retry their migration. (Which folders and which messages are causing problems will hopefully be discernible in Transend logs.) Ha! If you've read this far, then I'd also say that I welcome any advice on changes to increase performance on MIGR, such as whether trying to minimize indexing as I've done is useful. Current configurations of the two servers follow. =========================================================================== PRODUCTION: =========================================================================== # 1.0.13: /etc/dovecot.conf log_path: /var/log/dovecot.log info_log_path: /var/log/dovecot.log protocols: imaps imap listen: *:143 ssl_listen: *:993 ssl_cert_file: /etc/pki/dovecot/certs/dovecot.pem ssl_key_file: /etc/pki/dovecot/private/dovecot.key login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/imap-login login_processes_count: 20 login_max_processes_count: 500 max_mail_processes: 1524 first_valid_uid: 100 mail_location: mbox:~/Mail:INBOX=/var/mail/%u:INDEX=/var/spool/dovecot-indexes/%u/ mbox_read_locks: dotlock mbox_write_locks: dotlock mbox_dotlock_change_timeout: 60 mbox_min_index_size: 2048 namespace: type: private separator: / inbox: yes namespace: type: private separator: / prefix: Mail/ hidden: yes namespace: type: private separator: / prefix: ~/Mail/ hidden: yes namespace: type: private separator: / prefix: mail/ hidden: yes namespace: type: private separator: / prefix: ~/mail/ hidden: yes auth default: master_user_separator: * verbose: yes debug: yes debug_passwords: yes passdb: driver: passwd-file args: /etc/dovecot.deny deny: yes passdb: driver: passwd-file args: /etc/dovecot.transend master: yes passdb: driver: shadow passdb: driver: pam userdb: driver: passwd =========================================================================== MIGRATION: =========================================================================== # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-348.18.1.el5 x86_64 Scientific Linux release 5.10 (Boron) auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no first_valid_uid = 100 log_path = /var/log/dovecot.log mail_debug = yes mail_location = mbox:~/Mail:INBOX=/var/spool/concmail/%u:INDEX=MEMORY mbox_min_index_size = 50048 B mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace one { hidden = yes location = prefix = Mail/ separator = / } namespace three { hidden = yes location = prefix = mail/ separator = / } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = /etc/dovecot/dovecot.transend driver = passwd-file master = yes } passdb { driver = pam } protocols = imap service imap-login { process_min_avail = 15 service_count = 10 } service imap { executable = imap postlogin process_limit = 2048 } service postlogin { executable = script-login -d rawlog } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } deny = yes driver = passwd-file } passdb { args = /etc/dovecot/dovecot.transend driver = passwd-file master = yes } passdb { driver = pam } protocols = imap service imap-login { process_min_avail = 15 service_count = 10 } service imap { executable = imap postlogin process_limit = 2048 } service postlogin { executable = script-login -d rawlog } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 1000 }

1 0

dictionary attack defense
by Cliff Hayes 22 Oct '14

22 Oct '14

Does dovecot have any dictionary attack defenses yet? In the past I have had to implement defense from outside dovecot, but since dovecot is at the front lines and therefore is the first to know I'm hoping by now there is something we can set. For example, a limit on access failures per minut/hour/day or some such. If not why not?

4 8

authenticate plain, and virtual users
by Eric Abrahamsen 22 Oct '14

22 Oct '14

I'm running dovecot 2.2.14 on Archlinux. I've been using it with the isync syncing utility for quite some time with no problems, using the LOGIN authentication mechanism. Recently Isync was updated to support PLAIN, and I'm having trouble moving to that. The authenticate string that isync is sending is not the one that dovecot is expecting. I suspect this is because of how I have virtual users set up on my machine. This is a personal laptop, no other users, and so I didn't want to go through the rigmarole of creating more system users just for mail accounts. I also wanted everything stored under my home directory. So my dovecot config looks like this: # 2.2.14: /etc/dovecot/dovecot.conf # OS: Linux 3.16.4-1-ARCH i686 auth_verbose = yes disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_plugins = " fts fts_lucene" passdb { args = username_format=%u /etc/dovecot/passwd driver = passwd-file } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. } protocols = imap ssl = no userdb { args = uid=eric gid=users home=/home/eric/.mail/%d/%n username_format=%u default_fields = mail=maildir:/home/eric/.mail/%d/%n/mail driver = static } My /etc/dovecot/passwd looks like this: eric@ericabrahamsen.net:{PLAIN}password1 eric@paper-republic.org:{PLAIN}password2 When isync tries to log into the local dovecot using PLAIN, it sends the base64-encoded version of this string: eric(a)paper-republic.org\0eric\0password2 With my current dovecot config, telnet experimentation shows that dovecot will accept either of these two: \0eric(a)paper-republic.org\0password2 eric@paper-republic.org\0eric@paper-republic.org\0password2 Ie, either with or without the authorization ID, just like it says at http://wiki2.dovecot.org/Debugging/Authentication Given that I'm unlikely to be able to change how isync sends the string (and that it's really doing the right thing), are there alterations I can make to my dovecot config to get it to accept the authenticate string that isync is sending? Ideally, can I do that without having to set up system users? I've already tried using the other fields in the passwd file, putting "eric" and "eric(a)paper-republic.org" into the UID fields, just in case. No dice. Thanks in advance for any advice! Eric

1 0

Multiple user attributes in LDAP userdb query strings
by BINOTTO Luis SIDOR 21 Oct '14

21 Oct '14

Hello list, I have an issue with dovecot and Ldap... Any help will be grateful... I have my virtual users stored in an Active Directory database. I am using 2 attributes in AD to locate the user account: mail (their primary email address) and proxyAddresses (a multivalue attribute containing their mail aliases). I also control the mount point in which the mail is located with another attribute in AD, in this case I used "pager". I have dovecot 1.2.15 and there are no immediate plans to upgrade it. I configured Dovecot's deliver process in order to integrate sieve capability. I have configured userdb ldap and passdb ldap in Dovecot and have set up master and client sockets. I am using maildir format for directory layout. The problem is to set the variables home and mail that will define the mail location. The format must be like this: home: /Mailboxes/<mount point>/<user login>/ mail: /Mailboxes/<mount point>/<user login>/Maildir So, for a particular user (Login: user1, smtp: user1(a)domain1.com, alias smtp: user1_alias(a)domain1.com) the variables will be: home: /Mailboxes/AdmUsers/user1/ mail: /Mailboxes/AdmUsers/user1/Maildir Active Directory has the values in: mail:(user1@domain1.com), proxyAddresses:(user1_alias@domain1.com), sAMAaccountName(user1). I have defined home and mail in dovecot-ldap.conf. # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki.dovecot.org/UserDatabase/ExtraFields user_attrs = pager=home=/mailboxes/%$/%u,mobile=quota_rule=*:storage=%$M If the mail is sent to the Principal SMTP (user1(a)domain1.com) in which the user part (%u) is the same as sAMAccountName, it works. The variable home is set correctly (home: /Mailboxes/AdmUsers/user1/). The problem is when the mail is sent to the smtp alias, in which the variable home is set incorrectly (home: /Mailboxes/AdmUsers/user1_alias/). There is a way to set two values to user_attrs?, in this case I would need to set pager and sAMAccountName (instead of %u), to it. Thanking you in anticipation... Attached is the out of dovecot -n # 1.2.15: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-686 i686 Debian 6.0.7 log_path: /var/log/dovecot.log protocols: imap imaps pop3 pop3s disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login mail_uid: 16343 mail_gid: 16343 mail_location: maildir:~/Maildir mail_debug: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugins(default): autocreate deleted_to_trash quota imap_quota expire mail_plugins(imap): autocreate deleted_to_trash quota imap_quota expire mail_plugins(pop3): quota expire mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape-eoh imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh lda: postmaster_address: postmaster(a)domain1.com mail_plugins: quota expire log_path: /var/log/dovecot.log auth default: mechanisms: gssapi gss-spnego login ntlm plain username_format: %Ln use_winbind: yes passdb: driver: pam userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail plugin: autocreate: Deleted Items autocreate: Sent Items autosubscribe: Deleted Items autosubscribe: Sent Items deleted_to_trash_folder: Sent Items quota: maildir:User quota quota_rule: *:storage=100M quota_rule2: Deleted Items:ignore quota_warning: storage=80%% /etc/dovecot/scripts/quota-warning.sh 80 quota_warning2: storage=90%% /etc/dovecot/scripts/quota-warning.sh 90 quota_warning3: storage=99%% /etc/dovecot/scripts/quota-exceeded.sh 100 expire: "Deleted Items" 1 "Deleted Items/*" 1 expire_dict: proxy::expire dict: expire: pgsql:/etc/dovecot/dovecot-dict-expire.conf " Notificacion Automatica: Este mensaje y cualquier archivo que se adjunte contiene informacion privilegiada y confidencial. Es para uso exclusivo del destinatario. Si usted ha recibido esta comunicacion por error, por favor avisenos inmediatamente. Automatic notification: This e-mail and any file transmitted with it are confidential and may be legally privileged. It is intended solely for the addressee and may not be disclosed to or used by anyone other than the addressee. If you have received this e-mail by mistake , please advise the sender immediately"

1 0

Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"
by Ralf Hildebrandt 21 Oct '14

21 Oct '14

After fixing the "duplicate compression" problem, we're now encountering "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.100)" in the logs. We already tried raising the ulimit, the max number of open files. Once we reach about 25k connections, we're getting the error above... for all local addresses. It seems as if the system cannot create any more outgoing connections. We already optimized: ---- snip ---- net.ipv4.tcp_fin_timeout=5 # down from 30s net.ipv4.tcp_tw_reuse=1 net.ipv4.tcp_tw_recycle=1 # http://redis4you.com/articles.php?id=012&name=Redis+high+traffic+connection… net.ipv4.ip_local_port_range=10000 65000 # http://www.fromdual.com/huge-amount-of-time-wait-connections net.ipv4.netfilter.ip_conntrack_max=524288 ---- snip ---- But still we get (once the load is rising beyond some point): # fgrep "Cannot assign requested address" /var/log/dovecot/dovecot.log |awk '{print $NF}' | sort | uniq -c | sort -n 142 local=10.x.x.100) 147 local=10.x.x.107) 148 local=10.x.x.106) 151 local=10.x.x.104) 151 local=10.x.x.109) 152 local=10.x.x.105) 156 local=10.x.x.110) 162 local=10.x.x.102) 165 local=10.x.x.101) 178 local=10.x.x.103) 189 local=10.x.x.108) We're using multiple local addresses when proxying to the backends -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

4 7

only inbox folder after courier-imap migration
by Luciano Gabriel Andino 21 Oct '14

21 Oct '14

Hello, after courier-dovecot-migrate.pl, the only folder appears in webmail menu is "Inbox". The others still are in Maildir "Maildir/.myfolder" and contains its "dovecot-uidlist" and "dovecot-keywords" files. May I need to edit some file? -- Saludos!! Luciano Andino GNU/Linux user #185103 Santa Fe - Argentina -----------------------------------------------

1 0

Dovecot Auth Issue
by Austin Einter 21 Oct '14

21 Oct '14

Dear All I have been able to setup postfix and dovecot. Through command line, I can send mail out. Now I have installed roundcube in mail server side, and I am able to access like https://mydomain/webmail.com Login was failing. Then I debugged and modified settings in dovecot and using PAM for authentication. Now I trying to login to email server. I am not sure if authentication by dovecot and pam is successful. I enabled logging for dovecot. The below logs I get when a user "try" logs in. Oct 21 07:44:55 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Oct 21 07:44:55 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Oct 21 07:44:55 auth: Debug: auth client connected (pid=15357) Oct 21 07:44:55 auth: Debug: client in: AUTH 1 PLAIN service=imap secured lip=128.199.214.27 rip=128.199.214.27 lport=993 rport=43323 resp=AHRyeUBsb2FkbXVsdGlwbGllci5jb20AdHJ5MTIz Oct 21 07:44:55 auth-worker: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Oct 21 07:44:55 auth-worker: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Oct 21 07:44:55 auth-worker: Debug: pam(try,128.199.214.27): lookup service=dovecot Oct 21 07:44:55 auth-worker: Debug: pam(try,128.199.214.27): #1/1 style=1 msg=Password: Oct 21 07:44:55 auth: Debug: client out: OK 1 user=try Oct 21 07:44:55 auth: Debug: master in: REQUEST 1571291137 15357 1 b3cc155dfd3bb2fd576bfeeceaf1ce3d Oct 21 07:44:55 auth: Debug: passwd(try,128.199.214.27): lookup *Oct 21 07:44:55 auth: Debug: master out: USER 1571291137 try home=/var/mail/ mail=maildir:/var/mail/try system_groups_user=try uid=5001 gid=5001*Oct 21 07:44:55 imap-login: Info: Login: user=<try>, method=PLAIN, rip=128.199.214.27, lip=128.199.214.27, mpid=15361, TLS *Oct 21 07:44:55 imap(try): Info: Disconnected: Logged out bytes=29/399* >From the logs above (in bold), I hope auth is successful, then in last line why it is logging out.., I am confused , not sure if auth is completely successful or not. Kindly experts please help. Best Regards, Austin

1 0

SMTP authentication setup
by Brian 21 Oct '14

21 Oct '14

At my company we've had a longstanding problem of not being able to send email from devices outside of our internal network and any specific IP address that we open the relay to. As it turns out, SASL has never been set up. I need to set up SASL ASAP but none of the guides I've found seem to work. This is the latest guide I tried: http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL I did everything on here minus the last part because it's on the same server. Also, instead of submission inet n - - - - smtpd I did: 127.0.0.1:1025 inet n - - - - smtpd After all is done, however, I'm unable to send any mail. Thunderbird just says sending message but doesn't send and I don't even get an error. I end up having to disable SASL again before I can send mail. Dovecot version 2.0.9 Postfix version 2.6.6 CentOS 6 I have Postfix, Dovecot, and ASSP on the same server. Thanks everyone. -- This email was Virus checked by Astaro Security Gateway. http://www.sophos.com

4 5

90-sieve.conf syntax - moving from v2.0.x to v2.2.x
by deoren 21 Oct '14

21 Oct '14

Hi, I'm currently running version v2.0.x in production (using Maildir storage) and it's been working well. I'm interested in moving to version 2.2.x and am preparing a test server to do so. As I have been merging the conf file changes between the two versions I noticed syntax changes for the 90-sieve.conf file. There are now 'locations' and presumably to keep referring to local content I'll need to use the 'file:' location type. On my production box (v2.0.x) I have 90-sieve.conf configured like so: sieve = /var/vmail/sieve/%d/%n/.dovecot.sieve sieve_default = /var/vmail/sieve/global.sieve sieve_dir = /var/vmail/sieve/%d/%n/sieve_dir Inside of the /var/vmail/sieve/%d/%n/ directory (i.e., /var/vmail/sieve/example.com/testuser/) I find: drwxr-xr-x 3 vmail vmail 64 Oct 19 12:07 . drwxr-xr-x 9 vmail vmail 101 Jun 21 10:47 .. lrwxrwxrwx 1 vmail vmail 25 Jun 21 11:10 .dovecot.sieve -> sieve_dir/roundcube.sieve -rw------- 1 vmail vmail 3694 Oct 19 12:07 .dovecot.svbin drwx------ 3 vmail vmail 38 Oct 19 11:58 sieve_dir and that works well. I look at the current wiki documentation: http://wiki2.dovecot.org/Pigeonhole/Sieve/Configuration and I find that the 'seive_dir' conf option is still listed, but the comments for it appear very similar to the comments that precede the 'sieve' conf option in the stock 90-sieve.conf file: # The location of the user's main Sieve script or script storage. The LDA # Sieve plugin uses this to find the active script for Sieve filtering at # delivery. The "include" extension uses this location for retrieving # :personal" scripts. This is also where the ManageSieve service will store # the user's scripts, if supported. Assuming that the 'sieve' and 'sieve_dir' conf settings have not been merged into just 'sieve' (and that I need to use the 'file:' location specifier), is this how I would configure the two settings for Dovecot 2.2.x? sieve = file:/var/vmail/sieve/%d/%n;active=~/.dovecot.sieve sieve_dir = file:/var/vmail/sieve/%d/%n/sieve_dir If the two have been merged, how would I go about configuring the 90-sieve.conf file to get the same results? Thanks for your help.

1 1