December 2017 - dovecot

ot: how to block persistent same invalid account, different IPs
by Joseph Tam 22 Dec '17

22 Dec '17

"Voytek Eymont" <voytek(a)sbt.net.au> > I've installed fail2ban, it seems to be working as it identified my failed > test logins, BUT, my question is: > > what can I do when I see same invalid name trying to login to dovecot, > different IP each time, how can I say block each IP as used by this name ? If each IP is only used once in a long while, what would be the point? In general, distributed attacks are very hard to stop if you have a default accept stance. I've observed that most of the attacks to my site are from the enormous Chinese stated owned public network superblocks. I finally got sick of them so I now spiral these IMAP/POP connections into the Scharwzschild radius of my firewall. It's a prophylactic measure and not a reactive system like fail2ban, and may not work for you if you got road warriors that frequent that part of the world. However, it did get rid of a metric ton of BFD connections. Joseph Tam <jtam.home(a)gmail.com>

1 0

ot: how to block persistent same invalid account, different IPs
by Voytek Eymont 22 Dec '17

22 Dec '17

I've installed fail2ban, it seems to be working as it identified my failed test logins, BUT, my question is: what can I do when I see same invalid name trying to login to dovecot, different IP each time, how can I say block each IP as used by this name ? or it that a bad idea ? I can see two persistent attempts as so: I don't have such user 'ignacio' or 'julian' # grep ignacio.munoz /var/log/dovecot.log | wc 178 3436 35624 # grep ignacio.munoz /var/log/dovecot.log | grep 'auth fail' | wc 178 3436 35624 # grep julian /var/log/dovecot.log | wc 178 3432 34321 # grep julian /var/log/dovecot.log | grep 'auth fail' | wc 178 3432 34321 last 6 tries, sometimes have just : <ignacio.munoz>, sometimes, with tld Dec 22 17:00:33 imap-login: Info: Disconnected (auth failed, 1 attempts in 8 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=157.122.183.218, lip=163.47.110.6, TLS, session=<Z4JniOdgkgCderfa> Dec 22 17:01:06 imap-login: Info: Disconnected (auth failed, 1 attempts in 7 secs): user=<ignacio.munoz>, method=PLAIN, rip=60.172.162.2, lip=163.47.110.6, TLS, session=<CsdriudgWAA8rKIC> Dec 22 18:58:26 imap-login: Info: Disconnected (auth failed, 1 attempts in 10 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=60.30.224.189, lip=163.47.110.6, TLS: Disconnected, session=<kvLWLelg0QA8HuC9> Dec 22 18:58:59 imap-login: Info: Disconnected (auth failed, 1 attempts in 7 secs): user=<ignacio.munoz>, method=PLAIN, rip=220.164.2.138, lip=163.47.110.6, TLS: Disconnected, session=<T7T5L+lgRADcpAKK> Dec 22 19:30:28 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=113.8.194.3, lip=163.47.110.6, TLS, session=<jfSgoOlgswBxCMID> Dec 22 19:31:09 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<ignacio.munoz>, method=PLAIN, rip=58.210.119.226, lip=163.47.110.6, TLS, session=<moAVo+lg8gA60nfi> -- Voytek

3 2

New Dovecot service: SMTP Submission (RFC6409)
by Stephan Bosch 22 Dec '17

22 Dec '17

Hi, As some of you know, I started implementing the SMTP submission proxy a few years ago. It acts as a front-end for any MTA, adding the necessary functionality for an SMTP submission service, also known as a Mail Submission Agent (MSA) (https://tools.ietf.org/html/rfc6409) The main reason I created this, back then, was implementing the BURL capability (https://tools.ietf.org/html/rfc4468) The main application of that capability -- together with IMAP URLAUTH -- is avoiding a duplicate upload of submitted e-mail messages; normally the message is both sent through SMTP and uploaded to the "Sent" folder through IMAP. Using BURL, the client can first upload the message to IMAP and then use BURL to make the SMTP server fetch the message from IMAP for submission, thereby avoiding a second upload. Apart from BURL, the submission proxy service also adds the required AUTH support, avoiding the need to configure the MTA for SASL authentication. More SMTP capabilities like CHUNKING and SIZE are supported, without requiring the backend MTA supporting these extensions. Other capabilities like DSN currently require support from the backend/relay MTA. At this point, the submission proxy is still pretty basic. However, it will provide a basis for adding all kinds of functionality in the (not so distant) future. For the first time, it will be possible to act upon message submission, rather than only message retrieval; e.g. plugins can be devised that process outgoing messages somehow. Examples of the things we could do are adding Sieve filtering support for outgoing messages, or implicitly storing submitted messages to the Sent folder. Once a plugin API is devised, you can create your own plugins. The reason I send this message now, is that this code is finally merged into the Dovecot master repository. This means that it is part of the upcoming 2.3 release. Now that it is merged, you can install and test it from Github if you like. Feedback is of course appreciated. The documentation is still pretty sparse, but there is currently not much to configure. Just add "submission" to the protocols and configure the relay MTA server. The configuration is currently only documented in the example configuration in doc/example-config/conf.d/20-submission.conf. The submission service is a login service, just like IMAP, POP3 and ManageSieve, so clients are required to authenticate. The same authentication configuration will also apply to submission, unless you're doing protocol-specific things, in which case you may need to amend your configuration for the new protocol. BURL support requires a working IMAP URLAUTH implementation. I've updated the automated Xi Debian package builder to create an additional dovecot-submissiond package. So, if you're using the Xi packages, you only need to install that package and configure the relay MTA. Regards, Stephan.

7 16

v2.3.0 released
by Timo Sirainen 22 Dec '17

22 Dec '17

https://dovecot.org/releases/2.3/dovecot-2.3.0.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.0.tar.gz.sig Some random notes: - This release is signed with a new PGP key 0x18A348AEED409DA1 (which is signed by the old key). - This fixes several compiling issues reported for the 2.3 release candidate. Also a few other fixes mainly for submission server and doveadm server. - We're still planning to make at least one (or two) more v2.2.x release before retiring it. It's now time for Christmas holidays though, so the next release will have to wait until the end of January. - We'll start distributing v2.3.x releases in apt/yum repositories in near future. There will be a separate email about it. Some repetition from the release candidate's announcement: There are several new and exciting features in v2.3.0. I'm especially happy about the new logging and statistics code, which will allow us to generate statistics for just about everything. We didn't have time to implement everything we wanted for them yet, and there especially aren't all that many logging events yet that can be used for statistics. We'll implement those to v2.3.1, which might also mean that some of the APIs might still change in v2.3.1 if that's required. We also have new lib-smtp server code, which was used to implement SMTP submission server and do a partial rewrite for LMTP server. Some of the larger changes: * Various setting changes, see https://wiki2.dovecot.org/Upgrading/2.3 * Logging rewrite started: Logging is now based on hierarchical events. This makes it possible to do various things, like: 1) giving consistent log prefixes, 2) enabling debug logging with finer granularity, 3) provide logs in more machine readable formats (e.g. json). Everything isn't finished yet, especially a lot of the old logging code still needs to be translated to the new way. * Statistics rewrite started: Stats are now based on (log) events. It's possible to gather statistics about any event that is logged. See http://wiki2.dovecot.org/Statistics for details * ssl_dh setting replaces the old generated ssl-parameters.dat * IMAP: When BINARY FETCH finds a broken mails, send [PARSE] error instead of [UNKNOWNCTE] * Linux: core dumping via PR_SET_DUMPABLE is no longer enabled by default due to potential security reasons (found by cPanel Security Team). + Added support for SMTP submission proxy server, which includes support for BURL and CHUNKING extension. + LMTP rewrite. Supports now CHUNKING extension and mixing of local/proxy recipients. + auth: Support libsodium to add support for ARGON2I and ARGON2ID password schemes. + auth: Support BLF-CRYPT password scheme in all platforms + auth: Added LUA scripting support for passdb/userdb. See https://wiki2.dovecot.org/AuthDatabase/Lua - Input streams are more reliable now when there are errors or when the maximum buffer size is reached. Previously in some situations this could have caused Dovecot to try to read already freed memory. - Output streams weren't previously handling failures when writing a trailer at the end of the stream. This mainly affected encrypt and zlib compress ostreams, which could have silently written truncated files if the last write happened to fail (which shouldn't normally have ever happened). - virtual plugin: Fixed panic when fetching mails from virtual mailboxes with IMAP BINARY extension. - doveadm-server: Fix potential hangs with SSL connections - doveadm proxy: Reading commands' output from v2.2.33+ servers could have caused the output to be corrupted or caused a crash. - Many other smaller fixes

1 0

detect suspicious logins
by Matthew Broadhead 22 Dec '17

22 Dec '17

does anyone know of a linux module (maybe similar to fail2ban) that could be installed which would monitor email logs (sign ins) and alert the user to any suspicious activity on their account? i suspect it would need to log geo location, device type and ip address to a database. it seems like a module like this would be very useful and should exist already? thanks in advance

4 3

Re: Disable ssl validation for replication?
by Joseph Tam 22 Dec '17

22 Dec '17

Joseph Ward writes: > I'm aware of at least a couple of fallback options: > ??? -have a self-signed cert for replication and use the Let's Encrypt > one for IMAP/POP > ??? - create firewall rules allowing them to connect to each other over > the public internet so that it can validate the proper cert > ? > These are both much less palatable than simply disabling the cert > validation if it's possible. Maybe instead of disabling the check, appease it by supplying (in /etc/hosts) an alternate mapping of the FQDN subject of your certificate to your internal IP: 10.x.x.x your.sync.target Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: detect suspicious logins
by Joseph Tam 21 Dec '17

21 Dec '17

Matthew Broadhead <matthew.broadhead(a)nbmlaw.co.uk> wrote: >> does anyone know of a linux module (maybe similar to fail2ban) that >> could be installed which would monitor email logs (sign ins) and alert >> the user to any suspicious activity on their account? I just monitor straight from the logs using homebrew utilties. @lbutlr" <kremels(a)kreme.com> > Fail2ban can protect email logins. Alerting a user because random IP > in Korean Middle School tried to login seems no helpful. > >> i suspect it would need to log geo location, device type and ip >> address to a database. it seems like a module like this would be very >> useful > > How? > > Blacklist failed logins. That protects everyone and doesn't induce panic. I just went through a long thread elsewhere on this topic. Fail2ban is mainly a counter brute force measure. If you have a strong password policy, the net result of using it is that it makes your logs smaller, and maybe saves some CPU cycles or from DoS for really intense bouts, but otherwise, does not add to security as good passwords makes BFD infeasible. *However*, if the attacker knows the approximate password (e.g. shoulder surfing), this may help, but eventually, the password will succumb to a patient diligent attack. What the OP is considering is if the password is divulged e.g. phishing attack or snarfed from another source. In this case, an intruder's authentication will succeed immediately. If a monitor spots someone authenticating from another continent than where the owner is supposed to be, or from 2 locations thousands of miles apart, or from 5 different location simultaneously, or tried to send a huge number of messages with many bounces, or was using a different mail clients that one historically used), it can signal the admin/user for further investigation. For users, I think reporting a login origin audit will be helpful, regardless of circumstances. However, it should be done out of band, if the assumption is someone else has control of the account. Joseph Tam <jtam.home(a)gmail.com>

1 0

Logouts/disconnections not being logged?
by Joseph Tam 21 Dec '17

21 Dec '17

In a previous thread Subject: Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded I reported the behaviour of MacOSX/iOS IMAP readers whereby it would use up all available connections (up to the mail_max_userip_connections setting) for mailbox searches, then log them all out, then repeat the cycle with another batch of mailbox searches, until all mailboxes were scanned. However, login/logout log counts don't square up. I would observe (for a particular user+ip) mail_max_userip_connections login entries, followed by *fewer* than mail_max_userip_connections logout entries. (I could not find any disconnections or other forms of termination.) The next peak connection count happened after another mail_max_userip_connections logins (implying the total connection count > mail_max_userip_connections), then another strings of logouts fewer than mail_max_userip_connections. For example, if mail_max_userip_connections=100, I would see 0 -> 100 logins -> 87 logouts -> 100 logins -> 87 logouts -> 100 logins -> 94 logouts -> 100 logins -> ... It appears that somewhere, somehow, IMAP session exits are not being logged. Is there a reason to explain this discrepancy? Joseph Tam <jtam.home(a)gmail.com>

1 0

Virtual folders: Panic: file mail-index-sync.c
by Andreas Tauscher 21 Dec '17

21 Dec '17

Hi! I have compiled Dovecot 2.33.2 and crated some virtual folders. When I create a virtual folder for all flagged mails with dovecot-virtual containing * flagged and I set in 15-mailboxes.conf mailbox virtual/Flagged { special_use = \Flagged comment = All flagged messages auto = subscribe } The dovecot is crashing when any virtual folder is accessed: Dec 21 01:07:59 mail dovecot: imap(transfer1(a)shidolya.co.tz): Panic: file mail-index-sync.c: line 413 (mail_index_sync_begin_to2): asserti on failed: (!index->syncing) Dec 21 01:07:59 mail dovecot: imap(test(a)test.local): Error: Raw backtrace:/usr/lib/dovecot/libdovecot.so.0(+0x935c2) [0x7f4ead13 95c2] -> /usr/lib/dovecot/libdovecot.so.0(+0x936ad) [0x7f4ead1396ad] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4ead0c9f61] -> /u sr/lib/dovecot/libdovecot-storage.so.0(+0xd4d4c) [0x7f4ead49ed4c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_begin_to+0x4 f) [0x7f4ead49ee2f] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_begin+0x1c) [0x7f4ead49eecc] -> /usr/lib/dovecot/modules/l ib20_virtual_plugin.so(virtual_storage_sync_init+0x20e) [0x7f4eabe9904e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x4 4) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage .so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /us r/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xd825) [0x7f4eac8d0825] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) [0x7f4ead407ae1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so (virtual_storage_sync_init+0x1096) [0x7f4eabe99ed6] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xd825) [0x7f4eac8d0825] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) [0x7f4ead407ae1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x1096) [0x7f4eabe99ed6] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] When I remove "auto = subscribe" everything working like expected. I got this crash only if I use "flagged" in the virtual folder. Other virtual folders like a unseen folder is working fine with "auto = subscribe" Andreas

1 0

ot: fail2ban dovecot setup
by voytek＠sbt.net.au 20 Dec '17

20 Dec '17

I'm trying to setup and test fail2ban with dovecot I've installed fail2ban, I've copied config from https://wiki2.dovecot.org/HowTo/Fail2Ban, and, trying to test it, attempted multiple mail access with wrong password, but, get this: # fail2ban-client status dovecot-pop3imap Status for the jail: dovecot-pop3imap |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/dovecot.log `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: # grep 'auth fail' /var/log/dovecot.log | grep voytek@k | wc 19 367 3749 and Dec 17 09:55:03 imap-login: Info: Disconnected (auth failed, 2 attempts in 5 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<bQ6mAX1gHcRur/an> Dec 17 09:55:12 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<Osk5An1gAKVur/an> Dec 17 09:55:20 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<xsq/An1gDN1ur/an> Dec 17 09:55:27 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<RVUkA31gm4xur/an> # cat dovecot-pop3imap.conf [Definition] failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.* ignoreregex = # systemctl status fail2ban ● fail2ban.service - Fail2Ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled) Active: active (running) since Sat 2017-12-16 22:35:14 AEDT; 12h ago Docs: man:fail2ban(1) Process: 2034 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS) Process: 6024 ExecReload=/usr/bin/fail2ban-client reload (code=exited, status=0/SUCCESS) Process: 2036 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=0/SUCCESS) Main PID: 2039 (fail2ban-server) CGroup: /system.slice/fail2ban.service └─2039 /usr/bin/python2 -s /usr/bin/fail2ban-server -s /var/run/fail2ban/fail2ban.sock -p /var/ru... Dec 16 22:35:14 systemd[1]: Starting Fail2Ban Service... Dec 16 22:35:14 fail2ban-client[2036]: 2017-12-16 22:35:14,657 fail2ban.server [2...9.7 Dec 16 22:35:14 fail2ban-client[2036]: 2017-12-16 22:35:14,657 fail2ban.server [2...ode Dec 16 22:35:14 systemd[1]: Started Fail2Ban Service. Dec 17 09:21:51 systemd[1]: Reloaded Fail2Ban Service. Dec 17 09:22:52 systemd[1]: Reloaded Fail2Ban Service. Dec 17 09:31:40 systemd[1]: Reloaded Fail2Ban Service. Hint: Some lines were ellipsized, use -l to show in full.

4 8