June 2017 - dovecot - dovecot.org

Re: localhost logins
by Daniel Miller 27 Jun '17

27 Jun '17

On 6/27/2017 1:33 AM, Daniel Miller wrote: > On 6/27/2017 12:42 AM, Fabian Schmidt wrote: >> >> Am 26.06.17 schrieb Daniel Miller: >> >>> On 2017-06-23 15:09, Marcus Rueckert wrote: >>>> On Fri, 23 Jun 2017 11:38:28 -0700 >>>> Daniel Miller <dmiller(a)amfes.com> wrote: >>>> >>>>> While auditing my logs after an account was compromised, I see a >>>>> number of entries like: >>>>> >>>>> Jun 23 11:32:18 bubba dovecot: auth: >>>>> ldap("one-of-my-accounts",127.0.0.1): invalid credentials >>>> >>>> webmail? >> >> Nagios or someone else monitoring dovecot? >> > Not running such - and they wouldn't be hitting multiple accounts. > Now I'm more confused. I changed Dovecot to listen only on a specific IP address - and I still see localhost log lines: Jun 27 12:03:27 bubba dovecot: auth: ldap(SomeUser(a)MyDomain.com,127.0.0.1): invalid credentials The only other thing I can think of - Postfix runs on this server and uses Dovecot SASL. Is it possible the Dovecot auth log line is caused by a Postfix connection attempt? Daniel

1 0

localhost logins
by Daniel Miller 27 Jun '17

27 Jun '17

While auditing my logs after an account was compromised, I see a number of entries like: Jun 23 11:32:18 bubba dovecot: auth: ldap("one-of-my-accounts",127.0.0.1): invalid credentials I'm trying to figure out where this login attempt is coming from. I do run ASSP (an SMTP proxy) on this server, as well as Postfix - but I wouldn't think there'd be any communication with Dovecot for those? Postfix does use Dovecot SASL - but I see separate log entries for Postfix authentication failures. There are of course plenty of external IP's listed in Dovecot logs - I'm just asking for possible causes for the localhost entries. -- Daniel

3 4

Released Pigeonhole v0.4.19 for Dovecot v2.2.31.
by Stephan Bosch 26 Jun '17

26 Jun '17

Hello Dovecot users, Here's the definitive 0.4.19 release. There is one additional fix. Changelog v0.4.19: * This release adjusts Pigeonhole to several changes in the Dovecot API, making it depend on Dovecot v2.2.31. Previous versions of Pigeonhole will produce compile warnings with the recent Dovecot releases (but still work ok). - Fixed bug in handling of implicit keep in some cases. Implicit side-effects, such as assigned flags, were not always applied correctly. This is in essence a very old bug, but it was exposed by recent changes. - include extension: Fixed segfault that (sometimes) occurred when the global script location was left unconfigured. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.19.t… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.19.t… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

v2.2.31 released
by Timo Sirainen 26 Jun '17

26 Jun '17

https://dovecot.org/releases/2.2/dovecot-2.2.31.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.31.tar.gz.sig This should be a great and stable release for the summer :) v2.2.32 is planned for the end of August. Hopefully soon afterwards we can get back to v2.3. * LMTP: Removed "(Dovecot)" from added Received headers. Some installations want to hide it, and there's not really any good reason for anyone to have it. + Add ssl_alt_cert and ssl_alt_key settings to add support for having both RSA and ECDSA certificates. + dsync/imapc, pop3-migration plugin: Strip trailing whitespace from headers when matching mails. This helps with migrations from Zimbra. + acl: Add acl_globals_only setting to disable looking up per-mailbox dovecot-acl files. + Parse invalid message addresses better. This mainly affects the generated IMAP ENVELOPE replies. - v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly. It could have deleted wrong mail's cache or assert-crashed. - v2.2.30 mail-crypt-acl plugin was assert-crashing - v2.2.30 welcome plugin wasn't working - Various fixes to handling mailbox listing. Especially related to handling nonexistent autocreated/autosubscribed mailboxes and ACLs. - Global ACL file was parsed as if it was local ACL file. This caused some of the ACL rule interactions to not work exactly as intended. - auth: forward_* fields didn't work properly: Only the first forward field was working, and only if the first passdb lookup succeeded. - Using mail_sort_max_read_count sometimes caused "Broken sort-* indexes, resetting" errors. - Using mail_sort_max_read_count may have caused very high CPU usage. - Message address parsing could have crashed on invalid input. - imapc_features=fetch-headers wasn't always working correctly and caused the full header to be fetched. - imapc: Various bugfixes related to connection failure handling. - quota=imapc sent unnecessary FETCH RFC822.SIZE to server when expunging mails. - quota=count: quota_warning = -storage=.. was never executed - quota=count: Add support for "ns" parameter - dsync: Fix incremental syncing for mails that don't have Date or Message-ID headers. - imap: Fix hang when client sends pipelined SEARCH + EXPUNGE/CLOSE/LOGOUT. - oauth2: Token validation didn't accept empty server responses. - imap: NOTIFY command has been almost completely broken since the beginning. I guess nobody has been trying to use it.

1 0

acl shared maildir with virtual users
by Rich Simcox 26 Jun '17

26 Jun '17

Can anyone point out where i'm going wrong with my dovecot sharedinbox setup with ACL i'm contemplating giving up with dovecot alltogether i've spent 3 days trying different paths to the virtual users mailboxes I seem to have two issues my acls are getting written to my sql db fine in roundcube i can see the shared folder but cant subscribe to it in thunderbird if i go to namespaces it sees the shared. namespace but its not listing anything in it even though my acls are written to the db please someone tell me what i'm missing i'm betting its something silly but i've been over and over the wiki here is my conf and below it an extract of my debug log # 2.2.28 (bed8434): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-642.3.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) auth_cache_size = 1 M auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_policy_hash_mech = sha512 auth_policy_hash_nonce = 78204771 auth_policy_hash_truncate = 64 auth_policy_request_attributes = auth_database=mail database=mail service=dovecot username=%{orig_user} authtoken_hash=$0$0$%{hashed_password} local_host=%{real_lip} local_port=%{real_lport} remote_host=%{real_rip} remote_port=%{real_rport} auth_policy_server_api_header = X-API-Key:dovecot:xxxxxxxxxxxx auth_policy_server_timeout_msecs = 3000 auth_policy_server_url = http://127.0.0.1:579/dovecot-auth-policy auth_username_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+%" auth_verbose = yes dict { acl = sqlite:/usr/local/cpanel/etc/dovecot/dovecot-dict-shares.conf.ext expire = sqlite:/usr/local/cpanel/etc/dovecot/dovecot-dict-expire.conf.ext } disable_plaintext_auth = no first_valid_uid = 201 lda_mailbox_autocreate = yes lmtp_save_to_detail_mailbox = yes login_greeting = Welcome to Motorsport Tools mail_access_groups = dovecot mail_debug = yes mail_plugins = acl quota quota_clone fts fts_solr mail_prefetch_count = 20 mailbox_list_index = yes namespace inbox { inbox = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox spam { auto = create special_use = \Junk } prefix = INBOX. separator = . type = private } passdb { args = /usr/local/cpanel/etc/dovecot/cpauthd-dict.conf driver = dict result_failure = return-fail } passdb { args = /usr/local/cpanel/bin/dovecot-wrap driver = checkpassword skip = authenticated } plugin { acl = vfile:cache_secs=86400 acl_anyone = allow acl_shared_dict = proxy::acl expire_cache = yes fts = solr fts_solr = url=http://lTkFlGxjRar1hZAW:Ocj1FRRvlUs5Udj6@127.0.0.1:8984/solr/dovecot/ quota_exceeded_message = Mailbox is full please archive you old mail zlib_save = gz } protocols = lmtp imap service auth { unix_listener auth-client { mode = 0666 } } service config { vsz_limit = 2 G } service dict { unix_listener dict { group = dovecot mode = 0660 } } service imap-login { client_limit = 500 inet_listener imap { address = *,:: } inet_listener imaps { address = *,:: } process_limit = 100 process_min_avail = 8 service_count = 0 vsz_limit = 128 M } service imap { process_limit = 1024 vsz_limit = 512 M } service lmtp { client_limit = 1 process_limit = 500 unix_listener lmtp { group = mail mode = 0660 user = mailnull } vsz_limit = 512 M } service managesieve-login { client_limit = 500 process_limit = 100 process_min_avail = 8 service_count = 0 vsz_limit = 128 M } service managesieve { process_limit = 1024 vsz_limit = 512 M } service quota-status { executable = quota-status -p postfix unix_listener quota-status { mode = 0666 } } ssl = required ssl_cert = </etc/dovecot/ssl/dovecot.crt ssl_cipher_list = ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /usr/local/cpanel/etc/dovecot/cpauthd-dict.conf driver = dict } userdb { args = /usr/local/cpanel/bin/dovecot-wrap driver = checkpassword } protocol imap { imap_capability = +NAMESPACE imap_client_workarounds = tb-extra-mailbox-sep imap_idle_notify_interval = 24 mins imap_logout_format = in=%i, out=%o, bytes=%i/%o mail_location = maildir:~/ mail_max_userip_connections = 60 mail_plugins = acl quota imap_quota imap_acl imap_zlib quota_clone virtual fts fts_solr namespace { hidden = no list = yes location = maildir:%%h/Maildir:INDEXPVT=~/mail/virtual/%u/shared/%%u prefix = Shared.%%u. separator = . subscriptions = no type = shared } namespace sent { hidden = yes list = no location = virtual:/usr/local/cpanel/etc/dovecot/virtual/sent:INDEX=~/mail/virtual/%u prefix = sent separator = . } namespace spam { hidden = yes list = no location = virtual:/usr/local/cpanel/etc/dovecot/virtual/spam:INDEX=~/mail/virtual/%u prefix = spam separator = . } } protocol lda { mail_plugins = quota quota_clone postmaster_address = root quota_full_tempfail = no } local_name home.servers.co.uk www.home.servers.co.uk { ssl_cert = </etc/dovecot/ssl/dovecot.crt ssl_key = # hidden, use -P to show it } local_name website1.com www.website1.com www.website2.com website2.com { ssl_cert = </var/cpanel/ssl/domain_tls/website1.com/combined ssl_key = # hidden, use -P to show it i see this alot Debug: acl vfile: reading file /home/server/mail/website2.com/sales/.ebay.Sent/dovecot-acl this is how my path currently looks in debug but i've tried all sorts Jun 23 22:32:47 ssd99 dovecot: imap(sales(a)website2.com): Debug: Namespace : type=shared, prefix=Shared.%u., sep=., inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:%h/Maildir:INDEXPVT=~/mail/virtual/sales@website2.com/shared/%u this is what my private namespace paths relate to Jun 23 22:32:47 ssd99 dovecot: imap(sales(a)website2.com): Debug: Namespace sent: type=private, prefix=sent, sep=., inbox=no, hidden=yes, list=no, subscriptions=yes location=virtual:/usr/local/cpanel/etc/dovecot/virtual/sent:INDEX=~/mail/virtual/sales@website2.com Jun 23 22:32:47 ssd99 dovecot: imap(sales(a)website2.com): Debug: fs: root=/usr/local/cpanel/etc/dovecot/virtual/sent, index=/home/server/mail/website2.com/sales/mail/virtual/sales@website2.com, indexpvt=, control=, inbox=, alt= please someone must know the answer

2 1

ACL problems on shared folder
by Thomas Robers 26 Jun '17

26 Jun '17

Hello, I've a Dovecot Server Version 2.2.30.2 running on CentOS 6.9 and there's a problem with acls on shared folder. We have some mailboxes which are shared and used as a "group mailbox" and also some user who share their inbox and only the inbox when they are on holiday e.g.. When I set "acl_defaults_from_inbox = yes" it's not possible to restrict the access to only the inbox, meaning that the user who wants to share only their inbox have to share the whole mailbox. On the other hand when I set "acl_defaults_from_inbox = no" it is not possible to create a folder direct under the inbox of a "group mailbox" and one gets a "permission denied" message. Is this the normal behavior normal? Although the user who wants to create the folder has all rights he gets a "permission denied" message? Why? Am I missing something important? Does anyone who uses shared mailboxes had the same problem and solved this? Any suggestion or information, that I probably miss is welcome. If needed here's my Dovecot configuration: > # 2.2.30.2 (c0c463e): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.18 (29cc74d) > # OS: Linux 2.6.32-696.3.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 > auth_debug = yes > auth_master_user_separator = * > auth_mechanisms = plain login > auth_verbose = yes > disable_plaintext_auth = no > mail_debug = yes > mail_location = maildir:/export/home/imap/%Lu/Maildir > mail_plugins = acl zlib mail_log notify > mailbox_idle_check_interval = 10 secs > mailbox_list_index = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mbox_write_locks = fcntl > namespace { > hidden = no > ignore_on_failure = no > inbox = no > list = children > location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u > prefix = shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace inbox { > hidden = no > inbox = yes > list = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = INBOX/ > separator = / > type = private > } > passdb { > args = /etc/dovecot/master-users > driver = passwd-file > master = yes > } > passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > } > plugin { > acl = vfile:/etc/dovecot/global-acls:cache_secs=300 > acl_shared_dict = file:/export/home/shared-db/shared-mailboxes > mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change > mail_log_fields = uid box msgid size from flags > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_global = /var/lib/dovecot/sieve/global/ > sieve_user_log = ~/.dovecot.sieve.log > zlib_save = gz > zlib_save_level = 6 > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > mode = 0666 > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_limit = 500 > process_min_avail = 20 > } > service lmtp { > inet_listener lmtp { > address = 127.0.0.1 > port = 24 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > ssl = required > ssl_cert = </etc/pki/dovecot/certs/mail.tutech.de.crt_chain > ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv3 !SSLv2 > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > driver = ldap > } > protocol lmtp { > mail_plugins = acl zlib mail_log notify sieve > } > protocol imap { > mail_max_userip_connections = 100 > mail_plugins = acl zlib mail_log notify imap_zlib imap_acl > } TIA & Regards, Thomas

1 0

Courier migration to dovecot
by j.emerlik 23 Jun '17

23 Jun '17

Hi, I'm almost ready to migrate Courier to Dovecot 2.2.31 but I have one question about home and mail directory. It's good idea to have same directory form home and mail ? Which scenerio will be better and why ? For example: A) Home: /home/doamin/user1 Mail: /home/doamin/user1 B) Home: /home/doamin/user1/home Mail: /home/doamin/user1 C) Home: /home/doamin/user1/ Mail: /home/doamin/user1/mail Thanks & regards, Jack

3 4

v2.2.31 release candidate released
by Timo Sirainen 23 Jun '17

23 Jun '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.31.rc1.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.31.rc1.tar.gz.sig Unless new bugs are found, this will be the final v2.2.31 release, which will be released on Monday. * LMTP: Removed "(Dovecot)" from added Received headers. Some installations want to hide it, and there's not really any good reason for anyone to have it. + Add ssl_alt_cert and ssl_alt_key settings to add support for having both RSA and ECDSA certificates. + pop3-migration plugin: Strip trailing whitespace from headers when matching mails between IMAP and POP3. This helps with migrations from Zimbra. + acl: Add acl_globals_only setting to disable looking up per-mailbox dovecot-acl files. + Parse invalid message addresses better. This mainly affects the generated IMAP ENVELOPE replies. - v2.2.30 wasn't fixing corrupted dovecot.index.cache files properly. It could have deleted wrong mail's cache or assert-crashed. - v2.2.30 mail-crypt-acl plugin was assert-crashing - v2.2.30 welcome plugin wasn't working - Various fixes to handling mailbox listing. Especially related to handling nonexistent autocreated/autosubscribed mailboxes and ACLs. - Global ACL file was parsed as if it was local ACL file. This caused some of the ACL rule interactions to not work exactly as intended. - auth: forward_* fields didn't work properly: Only the first forward field was working, and only if the first passdb lookup succeeded. - Using mail_sort_max_read_count sometimes caused "Broken sort-* indexes, resetting" errors. - Using mail_sort_max_read_count may have caused very high CPU usage. - Message address parsing could have crashed on invalid input. - imapc_features=fetch-headers wasn't always working correctly and caused the full header to be fetched. - imapc: Various bugfixes related to connection failure handling. - quota=imapc sent unnecessary FETCH RFC822.SIZE to server when expunging mails. - quota=count: quota_warning = -storage=.. was never executed - quota=count: Add support for "ns" parameter - dsync: Fix incremental syncing for mails that don't have Date or Message-ID headers. - imap: Fix hang when client sends pipelined SEARCH + EXPUNGE/CLOSE/LOGOUT. - oauth2: Token validation didn't accept empty server responses. - imap: NOTIFY command has been almost completely broken since the beginning. I guess nobody has been trying to use it.

4 5

sieve vacation message if ....
by lejeczek 23 Jun '17

23 Jun '17

hi fellas generic construct for(if possible): reply vacation message if address is not from add1@com1 add2@com2 would you share? many thanks L.

4 5

Trouble after Upgrade to v2.2.30.2 missing value for DOVECOT_
by Beng Hui Ong 23 Jun '17

23 Jun '17

Hi, I keep getting these errors after upgraded to 2.2.30.2. I can't seems to find what is going on. This is running a Freebsd 10.3-RELEASE-p11 :( Can someone please assist ? Jun 22 14:45:23 starlite2 dovecot: auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Jun 22 14:45:23 starlite2 dovecot: auth: Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Jun 22 14:45:23 starlite2 dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Jun 22 14:45:23 starlite2 dovecot: auth: Error: auth: environment corrupt; missing value for DOVECOT_ Jun 22 14:45:23 starlite2 dovecot: auth: Fatal: unsetenv(RESTRICT_SETUID) failed: Bad address Jun 22 14:45:23 starlite2 dovecot: master: Error: service(auth): command startup failed, throttling for 4 secs root@starlite2:/usr/ports/mail/dovecot2/work/dovecot-2.2.30.2/src/auth # dovecot -n # 2.2.30.2 (c0c463e): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-RELEASE-p11 amd64 auth_debug = yes auth_default_realm = ispworkshop.com auth_mechanisms = plain login auth_realms = ispworkshop.com auth_verbose = yes disable_plaintext_auth = no first_valid_uid = 5000 hostname = www3.ispworkshop.net last_valid_uid = 5000 lda_mailbox_autocreate = yes login_greeting = Ready. mail_gid = 5000 mail_location = maildir:~/ mail_plugins = quota expire mail_log notify mail_temp_dir = /var/tmp mail_uid = 5000 namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } postmaster_address = ongbh(a)ispworkshop.net sendmail_path = /usr/local/sbin/sendmail service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { process_min_avail = 1 } ssl = no userdb { driver = passwd } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { mail_max_userip_connections = 100 }

2 1