December 2016 - dovecot

CVE-2016-8562 in dovecot
by Aki Tuomi 05 Dec '16

05 Dec '16

We are sorry to report that we have a bug in dovecot, which merits a CVE. See details below. If you haven't configured any auth_policy_* settings you are ok. This is fixed with https://git.dovecot.net/dovecot/core/commit/c3d3faa4f72a676e183f34be960cff1… and https://git.dovecot.net/dovecot/core/commit/99abb1302ae693ccdfe0d57351fd42c… Important vulnerability in Dovecot (CVE-2016-8562) CVSS score: 7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Affected version(s): 2.2.25.1 up to 2.2.26.1 Fixed in: 2.2.27.1rc1 Short summary: Dovecot auth component can be crashed by remote user when auth-policy component is activated. If auth-policy component has been activated in Dovecot, then remote user can use SASL authentication to crash auth component. Workaround is to disable auth-policy component until fix is in place. This can be done by commenting out all auth_policy_* settings. Aki Tuomi Dovecot oy

6 12

SAML | Input buffer full (no auth attempts in 0 secs)
by mj 04 Dec '16

04 Dec '16

Hi, In my journey to enable SAML auth for our webmail (sogo.nu) I have created a password-less dovecot imap listener on 127.0.0.1/32, so that once a user is SAML authenticated for the SOGo webmail, SOGo can connect to dovecot on 127.0.0.1:143 with something like "01 LOGIN username randompassword". Watching this (tcpflow) as it happens,i can see the following auth attempt coming from sogo: > 1 login "username" "eF7VVm1vmzAQ/iuI77wY8kJQEy1t2inSukpJVU37UhlzJN7AjmyzZPv1Owfgkdjfkgkfldlkfjg9jQNMvaNZMm7RvifC/Pc/ecfaFpkcdTrUEZLoW1K3Kh4+rn2C6ViCXVXMeCFqBjw+Ll9PZDHLh+TFsPu3ERmozttTGb2PO22627DV2pVl7g+8T7dPthydZQUIcLbahgYFsPoDQmHNsYzbbms7E9nz32B8kIEuY7oxFETi8bpE6U9MAZjiiLUiABzdB1rnUJ8zqSQX+fDBwSOH54T6I49GPiu2Q4+GxPLmps9Wk1qUrTWBtP3QIUN24pShfS0qOlWXsKaF5or7ZceId++yDLMvkCzDQhPyId85l1I1VBsYLf8URcUjPHUyerj8al0BtgPOOQ2pM1lBsuvjbp9jGbBE26KykyXjlWnbkFs5bpy11hRZwAVaBa8CcCzaih1kdp7sSdmmYG1C8U9mM/2lNoLbDaDYeK55ZALVcyPOJwefde1qwFjuYrIYWzkdpgp8QC9EYKDfdybD/eDC9JQAbX08tr0huSYBDOZv3+VUD6/evQJ4HtTRo2TtR9ZGqYQopSXvGjK0yXgETDiZnoAL0InHTAm+jTMkXwDBCFUZxVeY4s9VzhWL3CSgGGpkh8A6+N22I6mWc/hk8Au8xmLZaGGiiwL9YUx1e8LgZrCbrS21yksBvbgzDssWGUOQFLe04vooDwoscmtAwGpIBBEHYzlCdAcswsGsFcPjrKsddsIBs8uK6YDGrzuEWOdBAx8ZTgi7aCdsTW4cMtLQY7FBSGuioOTZYlcRQPzy16X5FuvOYxaSbgTsOK2daNwKNL8+z4edokyJkthqoMdaW05DzQvwcLtGJvvGzy+w+" Note, the actual 'password' is even longer. This connection attempt is causing dovecot to throw the following error: > Dec 02 22:34:33 imap-login: Info: Disconnected: Input buffer full (no > auth attempts in 0 secs): user=<>, rip=x.y.z.32, lip=x.y.z.68, > session=<d+o3tLNCaOvAV48g> and > BYE Input buffer full, aborting So this doesn't work. :-( The question: is there a way to make this work? (make the input buffer larger, for example..?) Or any other ideas to make this work? Thanks in advance, MJ

2 2

move IMAP folder
by James 04 Dec '16

04 Dec '16

I am trying to move an IMAP folder from Thunderbird and nothing happens. What /var/log file should I look in?

1 0

RE: First steps in Dovecot; IMAP not working
by Richard 04 Dec '16

04 Dec '16

> Date: Tuesday, October 18, 2016 13:12:39 +0200 > From: Moi <anic297(a)mac.com> > > Thank you. It worked and I now have several log files to check. > > In the meantime, I've tried once again to send a message to > "mailtest" from an outside address; this time, I got an error reply: > > This report relates to a message you sent with the following header > fields: > > Message-id: <00e201d2290f$67da8c70$378fa550$(a)mac.com> > Date: Tue, 18 Oct 2016 09:15:21 +0200 > From: Moi > To: 'Mail Test' <mailtest(a)barbu.sytes.net> > Subject: Test > > Your message cannot be delivered to the following recipients: > > Recipient address: mailtest(a)barbu.sytes.net > Reason: Illegal host/domain name found > <end of reply> > > Yet another area with a problem; at least this is now a valid > reason for it to not work. > Is this a misconfiguration of my DNS server? Assuming that "barbu.sytes.net" is the intended hostname (not something made up to obscure the real name), there is an MX-record for that that points to "mail.barbu.sytes.net", but there is no A-record for the "mail." hostname. There is an A-record for "mail.sytes.net", in case that is what you were intending, in which case you'd need to fix the MX on "barbu.sytes.net".

2 1

Show pigeonhole version?
by MRob 04 Dec '16

04 Dec '16

How can I query the current pigeonhole version from a running instance to verify it is what I expect? Possible to get `dovecot --version` to show things like that?

2 1

No stats under FreeBSD 10.3
by Ruud Boon 04 Dec '16

04 Dec '16

HI, I’m currently testing the stats module of Dovecot (2.2.26.0 (23d1de6)) Looks like there no statistics under FreeBSD. Server isn’t busy yet but got at least a few connection open. Added mail_plugins = $mail_plugins stats plugin { stats_refresh = 30 secs stats_track_cmds = yes } doveadm stats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits 1478031539 0.000000 0 0 0 0 0 0 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Cheers, Ruud

4 5

CentOS 7
by Eric Broch 04 Dec '16

04 Dec '16

Hello List, I'm building a dovecot-2.2.27 RPM for CentOS 7 and running into some issues The dovecot.spec (http://pkgs.fedoraproject.org/cgit/rpms/dovecot.git/tree/dovecot.spec) file runs 'autoreconf -I . -fiv' for aarch64 support just before the %configure option but is failing This worked fine on <= 2.2.26.0 when there was an m4/*.m4 directory (with *.m4 in it) in the sources. Is there something I should be aware of? Was the m4 directory removed for a reason? As a workaround I created the m4 directory and everything worked out, but is this the best solution? Eric

2 2

Too many references: cannot splice
by Sebastian Köhler 02 Dec '16

02 Dec '16

Hello, multiple times per day one of our Dovecot servers has the problem that it suddenly refuses to accept new connections and then floods the logs with these messages: Dec 2 12:43:06 alfa3201 dovecot: pop3-login: Error: fd_send(pop3, 18) failed: Too many references: cannot splice Dec 2 12:43:07 alfa3201 dovecot: pop3-login: Error: fd_send(pop3, 18) failed: Too many references: cannot splice Dec 2 12:43:07 alfa3201 dovecot: imap-login: Error: fd_send(imap, 16) failed: Too many references: cannot splice Dec 2 12:43:07 alfa3201 dovecot: imap-login: Error: fd_send(imap, 16) failed: Too many references: cannot splice We have to either do a restart of the server or a doveadm kick on all users to make it reachable again. On my search for a solution I found a similar report from March[1] however without a fix. [1] http://dovecot.org/pipermail/dovecot/2016-March/103514.html dovecot -n # 2.2.24 (a82c823): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.17-040417-generic x86_64 Debian 8.6 auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log default_client_limit = 8003 default_process_limit = 2000 default_vsz_limit = 512 M disable_plaintext_auth = no listen = * login_greeting = [CENSORED] - ready. mail_location = maildir:~/Maildir:CONTROL=/opt/dovecot/control/%n-control:INDEX=/opt/dovecot/index/%n mail_plugins = " stats quota" namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = dovecot-%s driver = pam } plugin { quota = fs:%n(soft quota) sieve = ~/.dovecot.sieve sieve_dir = ~/sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 30 secs stats_session_min_time = 15 mins stats_track_cmds = no stats_user_min_time = 24 hours } protocols = " imap pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imaps { ssl = yes } } service imap-postlogin { executable = script-login /etc/dovecot/post-login/expire.sh } service imap { executable = imap imap-postlogin } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3-postlogin { executable = script-login /etc/dovecot/post-login/expire.sh } service pop3 { executable = pop3 pop3-postlogin } service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota { group = postfix mode = 0660 user = postfix } } service stats { fifo_listener stats-mail { mode = 0666 user = dovecot } } ssl_ca = </etc/ssl.crt/ca-admin.crt ssl_cert = </etc/ssl.crt/admin.crt ssl_key = </etc/ssl.key/admin.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } protocol imap { imap_capability = +XLIST +NAMESPACE METADATA QUOTA imap_idle_notify_interval = 1 mins mail_max_userip_connections = 500 mail_plugins = " stats quota imap_quota imap_stats" } protocol pop3 { mail_max_userip_connections = 500 mail_plugins = " stats quota" pop3_client_workarounds = outlook-no-nuls oe-ns-eoh }

2 2

Defining INDEX target to other location than maildir seems to have no effect.
by Julian Sternberg 02 Dec '16

02 Dec '16

Dovecot Version 2.2.13 Linux Distribution: Debian Jessie CPU Architecture: x64 Filesystem: GlusterFS/NFS, XFS for Base System/Index Files. Two Dovecot/Postfix nodes accessing same GlusterFS/NFS Maildir. Regardless what i choose in mail_location (:INDEX=MEMORY or :INDEX=/var/indexes/%d/%n) all Mailbox index files will still get created within the users mail_location maildir: ~/Maildir My mail_location Maildir directory is shared on GlusterFS mount so i need to get index files away from this share due locking mechanism and faster caching. The weird is, if i set INDEX to /var/indexes, the index files getting created sometimes but then not updated frequently and exist parallel on Maildir which are mostly newer than on /var/indexes. If you delete the dovecot.index* files from Maildir, they will get recreated immediatly on Imap access but not on the alternative set INDEX location, they are getting recreated within Maildir again. Here is doveconf -n Output: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 auth_mechanisms = plain login cram-md5 disable_plaintext_auth = no first_valid_uid = 2000 hostname = censored.hostname.com last_valid_uid = 2000 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * lock_method = dotlock mail_fsync = always mail_gid = 2000 mail_home = /storage/vmail/%d/%n mail_location = maildir:~/Maildir:LAYOUT=fs:INDEX=MEMORY mail_nfs_storage = yes mail_privileged_group = vmail mail_temp_dir = /var/tmp mail_uid = 2000 maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace inbox { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Items" { auto = no special_use = \Trash } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = no special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule3 = Sent:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /storage/vmail/%d/%n/sieve/dovecot.sieve sieve_before = /storage/vmail/sieve/dovecot.sieve sieve_dir = /storage/vmail/%d/%n/sieve sieve_global = /storage/vmail/sieve } postmaster_address = postmaster(a)censored.hostname.com protocols = " imap lmtp sieve pop3" quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = required ssl_ca = </etc/ssl/censored.hostname.com/ssl-bundle-mail.crt ssl_cert = </etc/ssl/censored.hostname.com/censored_hostname.com.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_key = </etc/ssl/censored.hostname.com/censored.hostname.com.key ssl_protocols = !SSLv2 !SSLv3 ssl_require_crl = no userdb { args = uid=2000 gid=2000 home=/storage/vmail/%d/%n allow_all_users=yes driver = static } protocol lmtp { mail_plugins = " quota sieve" } protocol lda { mail_plugins = " sieve quota" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = " quota imap_quota" } protocol sieve { mail_max_userip_connections = 10 } protocol pop3 { mail_plugins = " quota" pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }

3 3

maildir-size-fix.pl - The file command can wrongly detect gzipped mails as being Minix filesystems
by Rarylson Freitas 02 Dec '16

02 Dec '16

Hi, Some days ago, I have used the maildir-size-fix.pl script (cited in this mail thread: http://www.dovecot.org/list/dovecot/2013-January/087942.html, in available here: http://dovecot.org/tools/maildir-size-fix.pl) This is a very good script and helped me a lot! However, some compressed mails where misdetected as non-compressed mail. So I discovered that some versions of the file command (some old versions) can wrongly detect gzipped files as being Minix filesystems. Actually, the error was occurring in about 1 gzipped mail for each 60000 or 100000 mails. I reported this file command bug here: https://bugs.launchpad.net/ubuntu/+source/file/+bug/1646233. But I think it's worth to make a small improvement in maildir-size-fix.pl, making it more error prone. What do you, guys, think about this? This is the patch I'm proposing: ``` --- maildir-size-fix.pl.orig 2016-12-01 14:41:30.044689101 -0200 +++ maildir-size-fix.pl 2016-12-01 14:49:42.971197715 -0200 @@ -37,7 +37,10 @@ return $stat[7]; } - my $type=`file "$path"`; + # Detecting all possible types (keep going) since some versions of the file + # command can wrong detect gzip files as Minix filesystems. + # See: https://bugs.launchpad.net/ubuntu/+source/file/+bug/1646233 + my $type=`file -k "$path"`; my $program = ""; if ($type =~ /gzip/) { $program = "gunzip"; ``` -- *Rarylson Freitas*

2 1