July 2017 - dovecot - dovecot.org

10-ssl ssl = no but dovecot still reads certs
by lists＠lazygranch.com 22 Jul '17

22 Jul '17

I'm bringing up a new email server starting without TLS initially. In 10-ssl.conf I set ssl = no, but the default ssl_cert and ssl_key lines are not commented out. I got the obvious error message: ------------------------------ doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 12: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot -------------------------- No big deal, but I don't remember this being an issue the last time I set up a server. You would think if ssl=no, the ssl_cert and ssl_key files would not be opened.

3 2

Re: under some kind of attack
by Joseph Tam 22 Jul '17

22 Jul '17

mj <lists(a)merit.unu.edu> wrote: > - for external users, to ONLY be allowed to use an application specific > password. (or username and password, fine as well) > > Step one: making ldap password authentication valid only from our > internal network. I though: using allow_nets=192.168.1.0/24 for that passdb > > But I can't get that to work. :-( Unsure where exactly to define the > allow_nets, tried many variations on the theme already. > > Perhaps someone can help with the step one, and also tell me if the > approach outlined above is smart, valid and do-able in dovecot. As per my post: checkpassword. You can then use one password on Mondays, Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday fetched from a rot-13 database, and only from prime numbered IP addresses on weekends, if that's what you want. Gary Sellani <lists(a)lazygranch.com> writes: > Not applicable to most installations, but I use geographical filtering > on all ports other than 25. Fine if you are the only user of the email > system. If you're the only user, moving the IMAP/POP service to a nonstandard port will do most of that with much less bother, and you won't lock yourself out, requiring a ssh/edit firewall/reconnect. Been there, done that. > I get one hacker a week trying to guess passwords, and always from Digital Ocean VPS. abuse(a)digitalocean.com is fairly responsive. They usually nuke them pretty quickly. > I would like to see statistics on the success of such brute force > attacks. They can't be very successful these days. Even if the success rate is 0.00001%, you can do the arithmetic to see that's still a huge number of accounts. But you're right, if you have anything resembling a sensible password policy, they're just a log bloating nuisance. Joseph Tam <jtam.home(a)gmail.com>

2 1

FTS error Unknown user
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, sorry for previous message, i accidentaly send it before it was complete. Recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error everytime a email is received (and FTS is not working, of course): dovecot: indexer-worker: Error: User [censored] lookup failed: Unknown user I don't fully understand why FTS needs to do any user lookup during indexing but, anyway, how can i workaround it? This is relevant config: passdb { driver = static args = password=[censored] allow_nets=[censored] } userdb { driver = static args = home=/var/mail/vhosts/%d/%n/home master_user=%u } plugin { fts = solr fts_solr = url=http://[censored]:8080/solr/ fts_autoindex = yes fts_autoindex_max_recent_msgs = 1000 } FTS is fully configured and working on proxy side (which is, currently, also a backend for most of the users - i will split it in stages, just wanted to say that i have FTS already working). azur

1 1

FTS
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error after every email is received:

1 0

Problem compiling dovecot 2.2.31 on Solaris
by Luciano Mannucci 21 Jul '17

21 Jul '17

I'm trying to compile under SunOS 5.8 Generic_117350-28 sun4u sparc SUNW,Ultra-5_10 (I know it's a bit oldish :-) and I get this error: /bin/bash ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c -o pkcs5.lo pkcs5.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c pkcs5.c -fPIC -DPIC -o .libs/pkcs5.o pkcs5.c:9:20: error: stdint.h: No such file or directory make[4]: *** [pkcs5.lo] Error 1 What have I missed? I did: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var\ --mandir=/usr/share/man --docdir=/usr/share/doc/packages/dovecot\ --disable-ipv6 --enable-header-install\ make Is it reasonable? Thanks in advance, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 6

under some kind of attack
by mj 21 Jul '17

21 Jul '17

Hi all, It seems we are under some kind of password guessing attack: > Jul 18 21:33:33 auth: Info: ldap(username1,103.6.223.61,<W7wLl5xUfABnBt89>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:34:16 auth: Info: ldap(username1,221.4.61.180,<89WnmZxUrADdBD20>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:36:13 auth: Info: ldap(username2,117.243.180.225,<ESWBoJxUdQB187Th>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:50 auth: Info: ldap(username2,58.59.103.230,<j7fQopxUNgA6O2fm>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:56 auth: Info: ldap(username4,58.215.13.154,<gtY5o5xUlQA61w2a>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:18 auth: Info: ldap(username3,220.175.154.205,<lFxppJxUFADcr5rN>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:25 auth: Info: ldap(username5,14.142.29.142,<40zopJxUSgAOjh2O>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:27 auth: Info: ldap(username4,119.1.98.121,<JDQOpZxUCwB3AWJ5>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:54 auth: Info: ldap(username3,218.76.156.11,<OMqtppxUMADaTJwL>): invalid credentials (given password: 1q2w3e4r) Different IPs, different usernames, but all (almost) the same password. Any idea what we can do about this?? Any advice you could give us would be very much appreciated. MJ

7 18

application specific passwords
by mj 21 Jul '17

21 Jul '17

Hi, Further to the other thread about password guessing activities against our dovecot, I would like to implement application specific passwords on our dovecot. Googling results in some documents, but they are all a bit older: > https://www.happyassassin.net/2014/08/26/adding-application-specific-passwo… > https://www.dgsiegel.net/news/2013_05_21-application_specific_passwords_for… > http://www.justinbuchanan.com/blog/category/RoundCube > http://www.justinbuchanan.com/blog/post/2012/12/02/Application-Specific-Pas… Those articles are interesting, but also rather old. (I realse that this does not neccesarily mean: irrelevant or bad) Is there anone here with some additional notes, ideas, tips, trics on setting up application specific passwords with dovecot with virtual users? We are using samba AD as an authentication backend. MJ

3 5

Re: under some kind of attack
by Joseph Tam 21 Jul '17

21 Jul '17

> I would like to create a fail2ban filer, that scans for these lines: > >> Jul 20 11:10:09 auth: Info: ldap(user1,60.166.35.162,<cDFXHbxUQgA8piOi>): invalid credentials (given password: password) >> Jul 20 11:10:19 auth: Info: ldap(user2,61.53.66.4,<V+nyHbxU+wA9NUIE>): invalid credentials (given password: password) > > (as you can see, I have enabled auth_verbose_passwords to do this, > making me very uncomfortable...) > > Anyway: since there are only a few password variations, I would like to > block anyone using those passwords. With all the constraints and processing, I'll offer yet another option: use the checkpassword password authentication scheme. This will bypass post-authentcation log-sniffing and allow you direct access to username, password and client IP (the last I'm not positive about) at authentication time. Now you'll have everything you need to do any wild and crazy auth processing, including database searches and triggering firewall blocking based on whatever crietria you want (including common password use). As to how to integrate it into your dovecot, I'm not sure whether it's best to supplant the LDAP method and authenticate within the checkpassword script, or to put it as the first authentication method (ahead of LDAP) to get first crack at inspect at authentication data, or the fallback authentication method (after LDAP) to pick up all the failures. However, after running honeypots, I can tell you that although BFD attackers will common use passwords, any static list of abused passwords will miss a lot. (A common one they use is $password=variations($user) or variation($domain)). Number of auth failure limits should also be a criteria for banning. Extinct users are also good candidates for instant banning. Joseph Tam <jtam.home(a)gmail.com>

2 1

2.2.devel (0bee280) crashdump virtual plugin
by Thomas Leuxner 20 Jul '17

20 Jul '17

#0 0x00007f497ecdb067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 10092 selftid = 10092 #1 0x00007f497ecdc448 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0xfffe, sa_sigaction = 0xfffe}, sa_mask = {__val = {1024, 140722499998576, 94791001010256, 513, 139953641023651, 140722499998368, 94791001010256, 513, 11573297580199803136, 139953644744448, 139953641204307, 94791001010256, 140722499998464, 0, 139953641204665, 94791001010256}}, sa_flags = 2131669786, sa_restorer = 0x7ffc829fd301} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f497f0f05b6 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 backtrace = 0x56363ff17088 "/usr/lib/dovecot/libdovecot.so.0(+0x9f5be) [0x7f497f0f05be] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f6ac) [0x7f497f0f06ac] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f497f080fde] -> /usr/lib/d"... #3 0x00007f497f0f06ac in i_internal_fatal_handler (ctx=0x7ffc829fd350, format=<optimized out>, args=<optimized out>) at failures.c:670 status = 0 #4 0x00007f497f080fde in i_panic (format=format@entry=0x7f497f47af00 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffc829fd450, reg_save_area = 0x7ffc829fd390}} #5 0x00007f497f3cb6dc in mailbox_notify_changes_stop (box=<optimized out>) at mail-storage.c:1950 __FUNCTION__ = "mailbox_notify_changes_stop" #6 0x00007f497dc5aa6f in virtual_notify_changes (box=0x5636400cdbd8) at virtual-storage.c:696 bboxp_end = 0x563640015708 mbox = 0x5636400cdbd8 bboxp = 0x563640015180 #7 0x000056363f5e2652 in idle_finish (ctx=ctx@entry=0x56363ff64160, done_ok=<optimized out>, free_cmd=free_cmd@entry=true) at cmd-idle.c:46 client = 0x56363ff39e68 #8 0x000056363f5e2783 in idle_client_handle_input (ctx=ctx@entry=0x56363ff64160, free_cmd=free_cmd@entry=true) at cmd-idle.c:67 line = <optimized out> #9 0x000056363f5e284d in idle_client_input_more (ctx=0x56363ff64160) at cmd-idle.c:100 client = 0x56363ff39e68 #10 idle_client_input (ctx=0x56363ff64160) at cmd-idle.c:107 client = 0x56363ff39e68 #11 0x00007f497f105b22 in io_loop_call_io (io=0x56363ffae400) at ioloop.c:599 ioloop = 0x56363ff1f9b0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #12 0x00007f497f10717a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop-epoll.c:223 ctx = 0x56363ff214d0 io = <optimized out> tv = {tv_sec = 3, tv_usec = 496715} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #13 0x00007f497f105bbc in io_loop_handler_run (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop.c:648 No locals. #14 0x00007f497f105d68 in io_loop_run (ioloop=0x56363ff1f9b0) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #15 0x00007f497f08b6d3 in master_service_run (service=0x56363ff1f850, callback=<optimized out>) at master-service.c:666 No locals. #16 0x000056363f5de1d3 in main (argc=1, argv=0x56363ff1f5e0) at main.c:491 set_roots = {0x56363f8096c0 <imap_setting_parser_info>, 0x7f497f8d5540 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x56363ff17048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x56363f5f92b0 <login_client_connected>, failure_callback = 0x56363f5f8bf0 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x56363f602074 "auth-master" c = <optimized out>

2 13

SRS and vacation message
by Kacper Guzik 20 Jul '17

20 Jul '17

Hi i have similiar problem like here: http://www.iredmail.org/forum/topic11833-iredmail-support-vocation-respone-… email send : from : web123(a)gmail.com to : jacka(a)mail.com vocation sent back from : jacka(a)mail.com to : srs0=hmc8=v7=gmail.com=web123(a)mail.com postsrsd changing return-path from web123(a)gmail.com to srs0=hmc8=v7= gmail.com=web123(a)mail.com this is no problem for me but sieve: Vacation's messages are always addressed to the Return-Path address it is possible some how change this ugly to header to normal? dovecot --version 2.2.29.1 (e0b76e3) # 2.2.29.1 (e0b76e3): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) doveconf: Warning: service auth { client_limit=125000 } is lower than required under max. load (150000) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 60 default_client_limit = 125000 default_process_limit = 25000 dict { quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no listen = * log_path = /var/log/dovecot.log login_trusted_networks = xxx mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_max_userip_connections = 128 mail_plugins = quota zlib expire mail_uid = 2000 maildir_broken_filename_sizes = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict sieve = /home/sieve/%Ld/%Ln/dovecot.sieve sieve_after = /home/sieve/dovecot.sieve sieve_default = /home/sieve/dovecot.sieve sieve_dir = /home/sieve/%Ld/%Ln sieve_global_dir = /home/sieve sieve_global_path = /home/sieve/dovecot.sieve sieve_max_redirects = 25 zlib_save = gz zlib_save_level = 9 } protocols = pop3 imap sieve lmtp service auth { service_count = 0 unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0777 user = vmail } } service imap-login { process_min_avail = 16 service_count = 0 vsz_limit = 64 M } service imap { process_limit = 4096 } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } user = vmail } service pop3-login { process_min_avail = 16 service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = root mode = 0666 user = root } user = root } ssl_ca = </etc/ssl/ca-bundle.crt ssl_cert = </etc/ssl/xxx.crt ssl_key = # hidden, use -P to show it submission_host = xxx userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota mail_log notify zlib } protocol pop3 { mail_plugins = quota zlib expire pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_fsync = optimized mail_plugins = quota sieve zlib postmaster_address = xxx } remote xxx { mail_max_userip_connections = 51200 }

1 0