May 2014 - dovecot - dovecot.org

[Dovecot] Segfault with passwd as a second userdb at auth_fields_rollback
by Jan Kończak 11 May '14

11 May '14

Hello, I've been trying to set up dovecot to support passwd-file + passwd/PAM auth. I made an unusual config (passwd-file as userdb failed to work for me), which uses static as userdb: =============== passdb { driver = passwd-file args = username_format=%u scheme=CRYPT /etc/dovecot/users } userdb { driver = static default_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n } passdb { driver = pam } userdb { driver = passwd } =============== While passwd-file+static worked well, passwd/PAM caused trouble: $ doveadm user xxx doveadm(root): Error: userdb lookup(xxx): Disconnected unexpectedly field value If passwd-file had the user, check went fine; otherwise it segfaulted. The crash has been accompanied by a syslog message: kernel: auth[9788]: segfault at 18 ip 0000000000416391 sp 00007fffd11a3d90 error 4 in auth[400000+44000] Translating address lead me to: 0000000000416390 <auth_fields_rollback>: 416390: 53 push %rbx 416391: 48 83 7f 18 00 cmpq $0x0,0x18(%rdi) I was using packages from http://packages.atrpms.net/dist/el6/dovecot/ To be precise, dovecot-2.2.10-1_14.el6.x86_64.rpm I tampered with the src.rpm, upgraded spec&sources to match 2.2.12. It didn't help, so I tries to "workaround" this. The bug has gone when in src/auth/auth-fields.c:210 I added check if the field ptr is not null. As it's a userdb query, it seems that for some reason (static?) in src/auth/auth-request.c:1058 the function auth_fields_rollback is called with null request->userdb_reply Now it works fine: $ doveadm user xxx field value uid 1000 gid 100 home /home/xxx mail maildir:~/.maildir system_groups_user xxx $ doveadm user jkonczak@ast... field value uid 103 gid 103 home /var/spool/mail/ast.../jkonczak mail maildir:~/.maildir So now virtual users get vmail uid/gid, system users get their uid/gid, home is fine etc. Below I attach the patch + full config. Regards, Jan Kończak =============================================== $ cat SOURCES/dovecot-2.2.12-auth_fields_rollback-nullptr_check.patch --- src/auth/auth-fields.c.orig 2014-05-11 16:17:49.755258666 +0200 +++ src/auth/auth-fields.c 2014-05-11 16:18:24.704946586 +0200 @@ -207,6 +207,7 @@ void auth_fields_rollback(struct auth_fields *fields) { + if (fields==NULL) return; if (array_is_created(&fields->snapshot_fields)) { array_clear(&fields->fields); array_append_array(&fields->fields, &fields->snapshot_fields); =============================================== $ dovecot --version 2.2.12 $ doveconf # passdb/userdb/auth related passdb { args = username_format=%u scheme=CRYPT /etc/dovecot/users default_fields = deny = no driver = passwd-file master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } passdb { args = default_fields = deny = no driver = pam master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } userdb { args = default_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n driver = static override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } userdb { args = default_fields = driver = passwd override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } ===============================================

2 1

[Dovecot] "doveadm penalty -a" doesn't work?
by Peer Heinlein 11 May '14

11 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We're running multiple instances on the same server. While doveadm penalty works: root@host:/etc/dovecot# doveadm penalty IP penalty last_penalty last_update 93.180.xxx.xxx 4 2014-05-10 12:21:08 12:21:08 80.153.xxx.xxx 0 2014-05-10 12:21:12 12:21:12 a seperate anvil-Socket doesn't work at all: root@host:/etc/dovecot# doveadm penalty -a /var/run/dovecot-example/anvil doveadm penalty [-a <anvil socket path>] [<ip/bits>] It just shows up the help message. (Dovecot 2.2.12) Peer - -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTbf41AAoJEAOLLpq5E82H/h4H/2VpFfrqG+dcW73dS8CAWXVM thWcj5/GKUDaE/MYKsATDmNenlPuKIHsC8+hM7pyB3kfA0d7EDP/aNcaOWdw16XE fq7PSoLWiPJcsTG6ArzyuJMYiCwb2TuFIimFjjlZWVqnB+iAVv0y7ESJ9De/dmzM eE3ct/JmuY+0MrRAKSNdDX/Dbaakh03/JQ3/GvAwYeTFgviCfa3D5hsYCfhDZbPC 2vE3A9D46SqhmrediuWdtnj6rAhYwfjS+77jXaK6NyYru0WtYf9ozgtt5pbb89Hd EKzdNyKdKsZEnQ1ubv7cj5671OwL1ikp/d8tJr3/l4tgRHWf2+BmuGJIoo8AFwE= =2gZD -----END PGP SIGNATURE-----

2 1

[Dovecot] ECDSA certificate support
by SIW 11 May '14

11 May '14

Does the latest version of Dovecot support ECDSA certificates? I had a look in: http://wiki2.dovecot.org/SSL but it didn't answer my question. Can someone please help or point me in the right direction? I'd also like to know if I can run an RSA cert AND an ECDSA certificate at the same time in Dovecot (like you can in Postfix). Many thanks.

1 0

[Dovecot] LDA can't read dovecot.conf
by Hit4er 11 May '14

11 May '14

Hi, i have a problem with lda with this error what i doing wrong? -- View this message in context: http://dovecot.2317879.n4.nabble.com/LDA-can-t-read-dovecot-conf-tp47853.ht… Sent from the Dovecot mailing list archive at Nabble.com.

4 5

[Dovecot] dovecot 2.2.9 - ssl_cert and ssl_key ignored
by Alexandru Bostina 11 May '14

11 May '14

Hello, It seems that Dovecot ignores the new /ssl_cert and ssl_key /settings. Using them in the dovecot configuration results in the error: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: ANY PRIVATE KEY] Using the old /ssl_//cert//_file/ and /ssl_key_file/ results in their being obsolete warning but no fatal error.

3 4

[Dovecot] Only part of sieve script works
by Sebastian Schlingmann 10 May '14

10 May '14

Hi, I am using Dovecot 2.2.11 with Pigeonhole on Arch Linux. I have a partly working sieve script (pasted to the end of this mail) which sorts mail into various imap folders. The first, third and fourth if blocks work just fine. The second and fifth block do not sort any mails. However, if I apply the script with sieve-test to mails the second and fifth block seem to work. How is the manual check with sieve-test different from the sieve filtering during mail delivery? I am thankful for any hints. Sebastian this is the sieve script I am talking about require "fileinto"; # Musik wegsortieren if anyof ( header :comparator "i;ascii-casemap" :contains "Subject" "Mixing.DJ", header :comparator "i;ascii-casemap" :contains "Subject" "John B", header :comparator "i;ascii-casemap" :contains "Subject" "FLOSS Weekly", header :comparator "i;ascii-casemap" :contains "Subject" "BrainStuff", header :comparator "i;ascii-casemap" :contains "Subject" "Nerdy Show", header :comparator "i;ascii-casemap" :contains "Subject" ["My Brother", " My Brother And Me"], header :comparator "i;ascii-casemap" :contains "Subject" "MoJoMenace", header :comparator "i;ascii-casemap" :contains "Subject" "GWJ Conference Call", header :comparator "i;ascii-casemap" :contains "Subject" "Welcome to Night Vale", header :comparator "i;ascii-casemap" :contains "Subject" "International Waters" ) { fileinto "Feeds.music"; stop; } # Youtube wegsortieren if address :all :comparator "i;ascii-casemap" :contains "From" "noreply(a)youtube.com" { fileinto "Feeds.Youtube"; stop; } # Awesomer wegsortieren if header :comparator "i;octet" :contains "Subject" "[The Awesomer]" { fileinto "Feeds.Awesomer"; stop; } # Feeds sortieren if address :all :comparator "i;octet" :contains "From" "sebi+feedmailer(a)mighty.selfhost.bz" { fileinto "Feeds"; stop; } # AIStA wegsortieren if header :comparator "i;ascii-casemap" :contains "Received" "webmail.awista.net" { fileinto "AIStA"; stop; }

2 1

[Dovecot] Denial of Service attacks against Dovecot v1.1+
by Timo Sirainen 10 May '14

10 May '14

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected. There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because the oldest connection always gets destroyed this requires quite a lot of activity from the attacker. This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper limit without being able to disconnect any of the oldest connections. Here are patches to fix this: http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3 http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339 http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to patch it yourself. For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.

3 2

[Dovecot] Strange behavior on with "listescape" and "lda_mailbox_autocreate" - double entries
by Patrick De Zordo 09 May '14

09 May '14

Hello Guys, we are using Dovecot since years; all working flawless but one strange behavior: Let me explain.. - we have enabled the "listescape" plugin in "15-lda.conf", "10-mail.conf" and "20-imap.conf". - we use the following default namespace in "10-mail.conf": --------------- 10-mail.conf ----------------------------------------- namespace { type = private prefix = separator = / inbox = yes subscriptions = yes } ---------------------------------------------------------------------------------------- - we use a sieve script that automatically generates folders in the following form (example): ---------------------------------------------------------------------------------------- ".INBOX.2014.05.patrick.incoming" for user "patrick(a)xx.com" ".INBOX.2014.05.patrick.outgoing" for user "patrick(a)xx.com" ".INBOX.2014.05.p\2edezordo.incoming" for user "p.dezordo(a)xx.com" ---------------------------------------------------------------------------------------- This is ok, but the automatically generated "subscriptions"-file of the user contains double lines (the second line is something strange?!); the second one should not be created, its totally wrong..! --------------- subscriptions ----------------------------------------- Trash Sent INBOX.2014.05.patrick.incoming INBOX.2014.05.patrick.outgoing INBOX.2014.05.p\2edezordo.incoming INBOX\2e2014\2e05\2ep\5c2edezordo\2eincoming <----- this line!?!?!? ---------------------------------------------------------------------------------------- Have you any ideas whats going on? Could this be a bug, or misconfiguration? Thanks in advance!! Greeting from Italy! Patrick.

2 6

[Dovecot] Disable IMAP for ONE user only
by SIW 09 May '14

09 May '14

I use MySQL to store my virtual users passwords and I am running the latest version of Dovecot. What I need to do is have one particular user have ONLY access to their email via Roundcube (webmail) and no IMAP/SMTP access. Therefore, how do I disable IMAP/SMTP access for just one user?

8 23

[Dovecot] Lifetime of redirect info stored by Sieve in .dovecot.lda-dupes
by Axel Luttgens 09 May '14

09 May '14

Hello, A quick question. How long are the Message-ID and recipient of forwarded messages (thru the redirect action) kept in .dovecot.lda-dupes? According to the code, it could be 24 hours; am I right? TIA, Axel

2 6