September 2014 - dovecot

Re: Is dovecot vulnerable to the shellshock/CVE-2014-6271 exploit?
by Joseph Tam 27 Sep '14

27 Sep '14

Timo Sirainen writes: >> Although I don't use it, it's plausible the checkpassword hook is also vulnerable >> via the MASTER_USER environment variable: >> >> http://wiki2.dovecot.org/AuthDatabase/CheckPassword > > This is one possibility, and it's the worst one because it could happen > before login. But it requires two things: > > 1. auth_username_chars setting must include the characters required in > the exploit, so "(){;" at least I guess. None of these characters are > enabled by default. But I think some people may have set this setting > to empty to allow all characters. > > 2. checkpassword must call bash, which also isn't done by default. > > Another possibility is is that in some setups the password (%w) may be > added to userdb fields, which ends up being exported to environment if > post-login scripts are used. Again Dovecot doesn't execute shell > automatically, but it may end up being executed by the configuration. > So this requires a valid username + password, and ability to change the > password to the bash exploit. Thanks for confirming what I suspected, Timo. The latter, if it is at all feasible, appears to be an "inside job" type of exploit, where the exploiter already has an account but can arbitrarily change their password. It's not as serious as the pre-login one, but worth addressing if the narrow circumstances of using post-login bash scripts apply. Joseph Tam <jtam.home(a)gmail.com>

1 0

doveadm penalty: who is 0.0.0.0?
by Peer Heinlein 27 Sep '14

27 Sep '14

Using doveadm penalty I just noticed a penalty for 0.0.0.0. Is this Postfix querying the auth-socket for his SASL-requests? I tried adding 0.0.0.0 to login_trusted_networks, but that doesn't help. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

3 2

Re: director
by Chris Lasater 26 Sep '14

26 Sep '14

The configuration and run/base_dir directories can be where ever you like. The locations Eduardo stated are the most appropriate for dovecot installed with an RPM. Mine were compiled and set in the home directory, so they are in a slightly different location. As long as you use the -c to point to the correct configuration file you should be good. For mine I kept my dovecot config file in the default location and put the director one elsewhere and created an alias, so that I can start the director by just typing director. This might make things easier for you to manage, then you can just stop it by running "doveadm -i <instance_name> stop" alias director="sudo -E PATH=${PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} /home/user/dovecot/sbin/dovecot -c /home/user/dovecot/etc/dovecot/director.conf" On 09/23/2014 05:00 PM, jjhoffart wrote: >> Thanks for the replies, >> I am still fairly new to dovecot and still learning. This is a quick run down of my setup: 3 servers running iRedMail (this is a package that installs dovecot 2.1.7, postfix, and LDAP). All three servers share an NFS backend. The same 3 servers are also sitting behind a load balancer. What I want to do is use these three servers as directors and mail servers. So from the replies I have gotten I understand that I need to create 2 config files 1 for director and 1 for dovecot. Now my next question is do these config files need to be stored in /etc/dovecot or /var/run/dovecot? Also is creating the second config file as simple as copying and renaming the dovecot.conf file? >> >> On Sep 23, 2014, at 2:26 PM, Eduardo Ramos <eduardo(a)freedominterface.org> wrote: >> >>> Hi, >>> >>> In fact you don't NEED a director. You can use two dovecot servers sharing a NFS storage with a normal (backend) implementation. It's good to see that page: http://wiki2.dovecot.org/NFS for some good recomendations. >>> >>> You must have a base_dir for each instance of dovecot you want to run, and a dovecot.conf as well. One could be director and other backend. I suggest you have two separated configuration directories, /etc/dovecot-director and /etc/dovecot-backend. Each with the respective configuration. Start dovecot with "dovecot -c /etc/dovecot-director/dovecot.conf". Backend is the same. >>> >>> In order to help more, provide us more details about your environment and doulbts. >>> >>> On 09/23/2014 03:57 PM, jjhoffart wrote: >>>> Hello, >>>> I am currently trying to setup a cluster of mail servers. I currently have two servers I am trying to cluster together. These servers will also have a shared NFS backend. I have read on the site that I will need to configure director since I am using NFS. I have read through all of the documentation on director but still need a little guidance to get things up and running. One of the questions I have is about the base_dir on the Multiple Invocations section of the wiki. It states that I will need to change the bas_dir to the new run directory, not sure what needs to happen here, can anyone help me out?

3 3

Namespace configuration over SQL
by Ain 26 Sep '14

26 Sep '14

Hello! I had working setup, where namespace settings (including prefix) was queried over SQL. Now, after installing new Dovecot to new server (using same configuration), this is not working anymore. Log shows following error: """ Initialization failed: namespace configuration error: list=yes requires prefix=yes to end with separator """ relevant part from dovecot-sql.conf.ext: """ user_query = \ SELECT \ 1002 AS uid \ , 1003 AS gid \ , CONCAT('/www/home/vmail/domains/', SUBSTRING(d.name, 1, 1), '/', d.name, '/', u.username) AS home \ , namespace_prefix AS 'namespace/default/prefix' \ , 'yes' AS 'namespace/default/inbox' \ , '%s' AS 'mail_service' \ FROM vm_domain d \ INNER JOIN vm_user u ON u.vm_domain_id = d.id \ WHERE d.name = '%d' AND u.username = '%n' AND u.active = 1 AND d.active = 1 """ namespace_prefix can be empty or INBOX. doveconf -n output: """ # 2.2.13: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE amd64 auth_debug = yes auth_verbose = yes disable_plaintext_auth = no listen = * mail_debug = yes mail_location = maildir:~/Maildir mmap_disable = yes namespace default { inbox = yes list = yes location = prefix = separator = . type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size mail_log_group_events = no } service imap { process_limit = 1480 } ssl_cert = </usr/local/etc/ssl/server.crt ssl_key = </usr/local/etc/ssl/server.key.unsecure userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol imap { imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE mail_max_userip_connections = 900 } protocol pop3 { mail_max_userip_connections = 300 } """ Seems like "prefix = " is interpreted as "prefix = yes". How I can solve this?

2 5

Is dovecot vulnerable to the shellshock/CVE-2014-6271 exploit?
by Joseph Tam 26 Sep '14

26 Sep '14

I'm right now handling this beach-ball sized grenade, and trying to figure out which of our services need to be locked down right away. Since dovecot passes values via environment variables based on user input (e.g. username, password, mailbox?) to auxilliary executables (including possibly bash shell scripts), is dovecot vulnerable to this exploit? (This is not a fault of dovecot, but rather bash's inadequate handling of environment variables.) For example, injection of this sort 1 LOGIN (){x;}exploit-code whatever I guess auth_username_chars would mitigate this particular attempt (assuming it can work), but other values such as mailbox names could also be injected post authentication. Can someone with working knowlegde of dovecot's internals confirm/deny whether this is a something that needs to be addressed? Joseph Tam <jtam.home(a)gmail.com>

4 4

How to configure dovecot imap to listen on multiple ports?
by Rick Thomas 26 Sep '14

26 Sep '14

I need my dovecot imap server to listen on ports 143, 993, and also 30143 and 30993. What syntax do I use in (I presume) the /etc/dovecot/conf.d/10-master.conf file to do this? Thanks! Rick

4 10

Does dovecot work OK on *BSD?
by Steve Litt 26 Sep '14

26 Sep '14

Hi all, I have a dovecot server on my Debian Wheezy desktop computer. My days with Debian are limited, and I'm investigating several 'BSD's: OpenBSD FreeBSD PCBSD NetBSD DragonflyBSD etc Is there any reason Dovecot wouldn't work on any of those? Does anyone know if those OS's have packages for Dovecot, or do I need to compile it myself? Thanks, SteveT Steve Litt * http://www.troubleshooters.com/ Troubleshooting Training * Human Performance

10 9

Indexing of mailf fts clucene aborts
by Rainer M Krug 25 Sep '14

25 Sep '14

Hi I am trying lucene to index my email. To create the index, I run the following command and the indexing aborts: ,---- | 09:42:20 ~$ doveadm -Dv index -u rainerkrug 'RMKrugGMAIL.*' | doveadm(rainerkrug): Debug: Loading modules from directory: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot | doveadm(rainerkrug): Debug: Module loaded: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/lib20_fts_plugin.so | doveadm(rainerkrug): Debug: Module loaded: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/lib21_fts_lucene_plugin.so | doveadm(rainerkrug): Debug: Loading modules from directory: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm | doveadm(rainerkrug): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 10): Symbol not found: _acl_user_module | Referenced from: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so | Expected in: flat namespace | in /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so (this is usually intentional, so just ignore this message) | doveadm(rainerkrug): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: dlopen(/usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so, 10): Symbol not found: _expire_set_deinit | Referenced from: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so | Expected in: flat namespace | in /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so (this is usually intentional, so just ignore this message) | doveadm(rainerkrug): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 10): Symbol not found: _quota_user_module | Referenced from: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so | Expected in: flat namespace | in /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so (this is usually intentional, so just ignore this message) | doveadm(rainerkrug): Debug: Module loaded: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so | doveadm(rainerkrug): Debug: Module loaded: /usr/local/Cellar/dovecot/2.2.13_1/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so | doveadm(rainerkrug): Debug: Effective uid=501, gid=20, home=/Users/rainerkrug | doveadm(rainerkrug): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir | doveadm(rainerkrug): Debug: maildir++: root=/Users/rainerkrug/Maildir, index=, indexpvt=, control=, inbox=/Users/rainerkrug/Maildir, alt= | doveadm(rainerkrug): Debug: Ignoring unknown cache field: pop3.order | doveadm(rainerkrug): Debug: Ignoring unknown cache field: binary.parts | doveadm(rainerkrug): Info: RMKrugGMAIL.[Gmail].All Mail: Caching mails seq=2..49011 | 48700/49010Assertion failed: (numDocsInStore*8 == directory->fileLength( (docStoreSegment + "." + IndexFileNames::FIELDS_INDEX_EXTENSION).c_str() )), function closeDocStore, file /tmp/clucene-M0PS6G/src/core/CLucene/index/DocumentsWriter.cpp, line 210. | Abort trap: 6 `---- Any suggestions? I am using dovecot on a Mac, Maverich=ks, installed via homebrew. If you need any further info, please let me know. Thanks, Rainer -- Rainer M. Krug email: Rainer<at>krugs<dot>de PGP: 0x0F52F982

1 0

Quota Woes
by Art Stephens 25 Sep '14

25 Sep '14

Trying to get quota to show up in IMP - Horde 5.x Seems it is not working with dovecot Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. root@mail:~# dovecot --version 2.0.19 root@mail:~# dovecot -n # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.11.0-26-generic x86_64 Ubuntu 12.04.4 LTS auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:~/mail/:INBOX=/var/mail/%u mail_plugins = " quota" passdb { driver = pam } plugin { quota = fs:User quota quota_rule = *:storage=300M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } protocols = " imap pop3" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } root@mail:~# quotaon -pa group quota on / (/dev/mapper/mail--vg-root) is on user quota on / (/dev/mapper/mail--vg-root) is on What am I missing? -- Arthur Stephens Senior Networking Technician Ptera Inc. PO Box 135 24001 E Mission Suite 50 Liberty Lake, WA 99019 509-927-7837 ptera.com facebook.com/PteraInc | twitter.com/Ptera ----------------------------------------------------------------------------- "This message may contain confidential and/or propriety information, and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company."

2 1

SSL issues when proxying
by Ralf Hildebrandt 25 Sep '14

25 Sep '14

I'm getting this in the log when proxying IMAP (three "valid certificate" messages, two "Invalid certificate" messages) Why is dovecot (acting as a proxy to another dovecot instance here) not recognizing the StartCom Extended Validation Server CA? . LOGIN ralf.hildebrandt(a)charite.de mypassword Sep 25 14:13:04 auth-worker(30859): Info: mysql(sql.charite.de): Connected to database mailservice Sep 25 14:13:04 imap-login: Debug: SSL: where=0x10, ret=1: before/connect initialization [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: before/connect initialization [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: unknown state [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: unknown state [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server hello A [127.0.0.1] Sep 25 14:13:04 imap-login: Info: Invalid certificate: unable to get local issuer certificate: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Invalid certificate: certificate not trusted: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=DE/ST=Berlin/L=Berlin/postalCode=12205/street=Charitestrasse 1/O=Charite Universitaetsmedizin/CN=imap.charite.de/emailAddress=postmaster(a)charite.de/serialNumber=HRAxxxx/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.1=Mitte/1.3.6.1.4.1.311.60.2.1.2=Berlin/1.3.6.1.4.1.311.60.2.1.3=DE Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=DE/ST=Berlin/L=Berlin/postalCode=12205/street=Charitestrasse 1/O=Charite Universitaetsmedizin/CN=imap.charite.de/emailAddress=postmaster(a)charite.de/serialNumber=HRAxxxx/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.1=Mitte/1.3.6.1.4.1.311.60.2.1.2=Berlin/1.3.6.1.4.1.311.60.2.1.3=DE Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server certificate A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server key exchange A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server done A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write client key exchange A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write change cipher spec A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write finished A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 flush data [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read finished A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=1: SSL negotiation finished successfully [127.0.0.1] . OK [CAPABILITY ... -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 3