August 2016 - dovecot

Re: Dovecot password policy
by Joseph Tam 05 Aug '16

05 Aug '16

Robert Blayzor <rblayzor.bulk(a)inoc.net> writes: > Is there a way to configure Dovecot to perhaps filter/enforce which > passwords are accepted before authenticating? Ie: Reject immediately > (without a database lookup) if password is not X characters in length? Yes, use the checkpassword hook. http://wiki.dovecot.org/AuthDatabase/CheckPassword I think there also some PAM module that you can stack into your system that will enforce password policies. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and Solr 6
by KSB 05 Aug '16

05 Aug '16

Hi! Dovecot 2.2.24 Had set up solr and new schema collection. Copied dovecot provided schema. There was an error with booleans (while getting schema via http), which I "solved" by removing "add-unknown-fields-to-the-schema" from solrconfig.xml. It is correct way to solve this? Anyway, I run tcpdump to see network activity between dovecot and solr: #tcpdump -i lo port 8983 and see nothing while doing: #doveadm fts rescan -u username(a)domain.tld no output also from doveadm. Noticed that dovecot.index.log reapears in user mail root if deleted. plugin { fts = solr fts_solr = url=http://localhost:8983/solr/dovecot/ debug .. } -- KSB

3 4

Problem with sieve configuration on dovecot+debian_jessie+ISPC3
by Filip Loncar [WarpMax | FederationServers] 05 Aug '16

05 Aug '16

I'm new-ish to dovecot and sieve (haven't used it extensively till now) and I'm not sure that I configured everything propperly. The problem is that we're trying to get the following sieve code to run: require ["fileinto", "regex", "date", "relational", "vacation", "duplicate"]; require "duplicate"; if duplicate :header "message-id" { discard; } else { redirect "<somemail1>"; redirect "<somemail2>"; redirect "<somemail3>"; redirect "<somemail4>"; redirect "<somemail5>"; redirect "<somemail6>"; keep; } keep; But we're constantly getting the following error: sieve: info: started log at Aug 02 08:13:21. main script: line 5: error: require command: unknown Sieve capability `duplicate'. main script: line 6: error: unknown test 'duplicate' (only reported once at first occurence). main script: error: validation failed. Both me and my collegue can't find what's wrong with the system. I would appreciate any kind of help on this matter. Below's my configuration. # dovecot --version 2.2.13 # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-45-pve x86_64 Debian 8.5 auth_mechanisms = plain login disable_plaintext_auth = no listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vnd.dovecot.duplicate passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_duplicate_default_period = 14d sieve_extensions = +vnd.dovecot.duplicate sieve_max_redirects = 6 sieve_plugins = sieve_extprograms } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 500 } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota } # uname -a Linux fero 2.6.32-45-pve #1 SMP Wed Mar 30 12:22:08 CEST 2016 x86_64 GNU/Linux It's a Debain Jessie VM running ISPC3. -- Srdac(an pozdrav | Best regards Filip Lonc(ar ___________________________________________ WarpMax hosting *WarpMax hosting* *A* Tehnolos(ki park Varaz(din, Zagrebac(ka 89, Varaz(din, Croatia - Europe *T * +385 42 492 129, 490 090, +385 99 5896 123 ___________________________________ Ova elektronic(ka poruka, kao i svi eventualni privici, su povjerljivi i namijenjeni iskljuc(ivo naznac(enom primatelju(ima). Ukoliko niste naznac(eni primatelj(i) ove elektronic(ke poruke, molimo da odmah obavijestite pos(iljatelja, a sve kopije ove elektronic(ke poruke (ukljuc(ujuc'i i privitke) trajno obris(ete. Svaka neovlas(tena upotreba, distribucija, reprodukcija ili priopc'avanje ove poruke zabranjeno je. WarpMax hosting ne preuzima odgovornost za sadrz(aj ove poruke i eventualnu s(tetu nastalu primitkom ove poruke i priloga sadrz(anih u poruci. Ne jamc(imo da je ova elektronic(ka poruka slobodna od virusa. WarpMax hosting ne preuzima odgovornost za bilo kakav gubitak ili s(tetu koja nastane zbog prisutnosti virusa u elektronic(koj poruci. This e-mail, including all attached files, if any, is confidential and intended for the sole use by the person(s) mentioned as recipient(s). If you are not the named recipient(s) indicated in this message, please notify the sender immediately, and permanently delete all copies of this message (including any attachments). Any review, use, distribution, disclosure, printing or copying of this e-mail other than by the intended recipient(s) is prohibited. WarpMax hosting accepts no liability for content of this message and any potential damage caused by this message and files attached to it. No warranty is given that this email is free of viruses. WarpMax hosting accepts no liability for any loss or damage caused by presence of a virus.

4 3

New password hashing scheme as plugin
by Andreas Meyer 05 Aug '16

05 Aug '16

Hi, I want to add a new password hashing scheme as plugin and provide it for the dovecot project, so that it will be included as optional plugin in future releases. Yet the plugin compiles fine and the .so file gets created. My approach is to call the functions password_scheme_register() and password_scheme_unregister() (src/auth/password-scheme.c) inside the plugin's _init() and _deinit() functions. When a client tries to login via imap the log shows an error message: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib20_newauth_plugin.so: dlopen() failed: /usr/local/lib/dovecot/lib20_newauth_plugin.so: undefined symbol: password_scheme_unregister That error obviously occurs, because the required lib is not linked into the plugin. Now my problem is to understand, whether this approach (via .so file) can be successful at all and if so, how? Do I need to link libs into it? Which would that be and how do I specify them in the Makefile.am? I assume, I don't need to link a lib, but need to use a hook to register the new hashing scheme, since the plugin is loaded into an already existing process, which needs to get extended. If this is true, which hook would that be and how do I register the new scheme? Or is there no way to accomplish this via a separated .so plugin? Should I extend the sources in /src/auth instead? (separat file for the hashing scheme with preprocessor instructions to include it only on demand) Thank you very much, Andreas

3 8

file/folder perms permissions
by Jim Pazarena 05 Aug '16

05 Aug '16

Forgive me if I am blind, but I cannot find default folder permissions. For the home directories, with the sub of mail: and deeper, I see some files with 660, some with 600, some folders with 770 some with 660 I am a bit confused. I manually messed with some files, and my MUA complained about permissions. So I got that mess fixed, and in doing so I noticed the seemingly contradictory permissions. Thanks!

3 2

SSL connection reset by peer
by Vince42 04 Aug '16

04 Aug '16

Hi, I am running a dovecot server and have set up an external monitoring, where every five minutes a login with SSL on port 993 is done. I usually get once a day an error "connection reset by peer - SSL connect", which goes away until the next monitor is executed. Initially I thought that raising the mail_max_userip_connections in protocol imap in 20-imap.conf to 256 should do the trick - but the error stays. What could be the reason for this error and which configuration values could be changed in order to avoid this error? I read a lot of different suggestions - but did not find a plausible explanation and recommendation. Thanks in advance! -- Cheers, \\|// Vince (o o) ----------------------------ooO-(_)-Ooo------------------------- ''' (o)_(o) [ ][0][ ] ô¿ô (=°o°=) World Domination by Copy and Paste [ ][ ][0] - (")_(") [0][0][0] () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Ooo. ---------------------------.ooO----( )------------------------- ( ) (_/ \_)

5 11

Dovecot 2.2.25 test failure
by Michael A. Peters 04 Aug '16

04 Aug '16

Operating system - 64 bit CentOS 7 gcc-4.8.5-4.el7.x86_64 Building against LibreSSL which has been fine for other releases, but it is a crypto test that is fails. Tried with LibreSSL 2.4.2 and 2.3.6 - both the build completes but fails the make check Dovecot 2.2.24 passes make check on both. This is where it fails: Making check in lib-dcrypt make[2]: Entering directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src/lib-dcrypt' for bin in test-crypto test-stream; do \ if ! /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ../../run-test.sh: line 21: 22369 Segmentation fault (core dumped) valgrind -q --trace-children=yes --leak-check=full --suppressions="$supp_path" --log-file=test.out.$$ $* ==22369== Invalid read of size 8 ==22369== at 0x113A47: dcrypt_ctx_sym_create (dcrypt.c:61) ==22369== by 0x119194: test_cipher_test_vectors (test-crypto.c:60) ==22369== by 0x1196F0: test_run_funcs (test-common.c:354) ==22369== by 0x119FC0: test_run (test-common.c:404) ==22369== by 0x113461: main (test-crypto.c:554) ==22369== Address 0x8 is not stack'd, malloc'd or (recently) free'd ==22369== ==22369== ==22369== Process terminating with default action of signal 11 (SIGSEGV) ==22369== Access not within mapped region at address 0x8 ==22369== at 0x113A47: dcrypt_ctx_sym_create (dcrypt.c:61) ==22369== by 0x119194: test_cipher_test_vectors (test-crypto.c:60) ==22369== by 0x1196F0: test_run_funcs (test-common.c:354) ==22369== by 0x119FC0: test_run (test-common.c:404) ==22369== by 0x113461: main (test-crypto.c:554) ==22369== If you believe this happened as a result of a stack ==22369== overflow in your program's main thread (unlikely but ==22369== possible), you can try to increase the size of the ==22369== main thread stack using the --main-stacksize= flag. ==22369== The main thread stack size used in this run was 8388608. Failed to run: ./test-crypto make[2]: *** [check-test] Error 1 make[2]: Leaving directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src/lib-dcrypt' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.Il5fdU (%check) Thanks for suggestions.

3 7

Attachment Storage problems
by Daniel van Ham Colchete 04 Aug '16

04 Aug '16

Guys, I started using single instance attachment storage a while ago but I had too many problems with it. My logs are filled with errors like: Aug 03 18:41:38 imap(user@domain): Error: read(attachments-connector(zlib(/srv/dovecot/mdbox/domain/user/storage/m.2))) failed: read(/srv/dovecot/attach/domain/5f/03/5f03f1d7da846fe9268473cae5219ae31019fd540dc67f58596d8390be4a0f2256158b1e9ba327841c513a6d927dbe9b767b7ad94f8ae5772674cccb3124b69d-7be2ef0e97036457c52000009331bd36[base64:19 b/l]) failed: open(/srv/dovecot/attach/domain/5f/03/5f03f1d7da846fe9268473cae5219ae31019fd540dc67f58596d8390be4a0f2256158b1e9ba327841c513a6d927dbe9b767b7ad94f8ae5772674cccb3124b69d-7be2ef0e97036457c52000009331bd36) failed: No such file or directory (uid=23484, box=INBOX) The funny thing is that the directory /srv/dovecot/attach/domain/5f/03/ doesn't even exist! So, I would like to stop using it and my question is: how? First we would need to stop writting things there while still reading it. How can I tell dovecot to stop using it on new e-mail? Second would be a dsync-like migration reinserting the attachments on the messages back. How can I do that? Most importantly, what do I do with the messages that lost attachments? Thank you very much. Best, Daniel Colchete

1 0

service-specific userdb affecting lmtp, quota-service
by Michael Fox 03 Aug '16

03 Aug '16

The service specific passwd-file userdb is causing quota-status and lmtp to fail. Using: userdb { args = ... /etc/dovecot/auth.d/%d/userdb.%s } I'm getting the following in /var/log/mail.err when I try to send/receive mail: Aug 1 15:46:57 n6mef-gw dovecot: auth: Error: passwd-file(mefpop(a)email.n6mef.org): stat(/etc/dovecot/auth.d/email.n6mef.org/userdb.quota-status) failed: Address family not supported by protocol Aug 1 15:47:08 n6mef-gw dovecot: auth: Error: passwd-file(mefpop(a)email.n6mef.org): stat(/etc/dovecot/auth.d/email.n6mef.org/userdb.lmtp) failed: Address family not supported by protocol I don't have a userdb.quota-status or userdb.lmtp. Is there something else that needs to be in the configuration to prevent these services from needing their own userdb? Thanks, Michael $ doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-76-generic x86_64 Ubuntu 14.04.4 LTS auth_mechanisms = cram-md5 auth_verbose = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota" mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = scheme=cram-md5 username_format=%n /etc/dovecot/auth.d/%d/passdb driver = passwd-file } plugin { quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=50MB quota_rule2 = Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_status_toolarge = 552 5.2.3 Message is too large quota_warning = storage=90%% quota-warning 90 %n %d quota_warning2 = storage=75%% quota-warning 75 %n %d } pop3_lock_session = yes protocols = pop3 imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { executable = pop3 postlogin process_limit = 25 } service postlogin { executable = script-login /etc/dovecot/postlogin.sh group = vmail user = vmail } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = /etc/dovecot/quota-warning.sh user = vmail } ssl = required ssl_cert = </opt/xsc/ssl/certs/n6mef-gw.crt ssl_key = </opt/xsc/ssl/private/n6mef-gw.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = username_format=%n /etc/dovecot/auth.d/%d/userdb.%s default_fields = home=/var/vmail/%d/%n driver = passwd-file } verbose_ssl = yes protocol lmtp { postmaster_address = xxxxxxxxxxxxxxxxx } protocol imap { mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 1 } remote 192.168.7.0/24/24 { ssl = yes } remote 192.168.7.0/27/27 { ssl = no } $

2 4

"Plaintext authentication disallowed on non-secure (SSL/TLS) connections" despite correct configuration to allow this
by Christian Balzer 03 Aug '16

03 Aug '16

Hello, this is basically a repeat of this query from last year, which unfortunately got a deafening silence for replies: --- http://dovecot.org/pipermail/dovecot/2015-August/101720.html --- I have mostly 2.1.7 (Debian Wheezy) mailbox servers and the current proxies are also of that vintage. So with "ssl=yes" and "disable_plaintext_auth=no" plaintext logins work, as per the documentation (http://wiki2.dovecot.org/SSL/DovecotConfiguration) and historically expected. Trying to use a 2.2.24 (Debian Jessie backports) dovecot proy with the same parameters fails like this: --- Aug 2 15:45:57 smtp12 dovecot: pop3-login: proxy(chibixxx(a)gol.com): Login failed to mbxx.xxx.gol.com:110: Plaintext authentication disallowed on non-secure (SSL/TLS) connections.: user=<chibixxx(a)gol.com>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, pid=16066 --- Changing things to "ssl=no" doesn't help and setting trusted networks only changes the last bit to have "secured" appended but still fails the same otherwise. I really need 2.2.x to behave the same way as before and documented. Any ideas and feedback would be most welcome. Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

1 1