August 2017 - dovecot

maildir boxes directory mode upon creation
by vadim 24 Aug '17

24 Aug '17

Hello, list ! Dovecot version is 2.2.27, running on Centos 6.7. Postfix is receiving mail and putting it into mailboxes. Dovecot just serves IMAP/POP3 connections to mailboxes. Virtual users are stored in DB. The problem is in directory mode (and thus file mode) for new mailboxes upon it's creation. If I create new record for new mailbox in DB and send mail to it, Postfix will create mailbox properly: Mode is 660, owner is imap:mail in my setup. If I create new record in DB and log in via IMAP for the first time, Dovecot creates mailbox and mode is 600, owner is imap:mail. Postfix cant put mails in tmp or new dirs in mailboxes created by dovecot with mode 600. I need dovecot to create new mailboxes (and files in it) within 660 mode. I tried to play around with "mail_access_groups" and "mail_privileged_group" wih no positive effect. I tried to change value for every "mode=" parameter in dovecot.conf to 660, but no luck. According to the documentation "Dovecot copies the permissions from the mailbox root directory". My mail_location is maildir:/var/mail/%u Rights for /var/mail/ (the root mail dir) are: [root@unknown-external-domain ~]# ls -lha /var/mail/ total 24K drwxrwx--- 5 postfix mail 4,0K Авг 23 14:27 . drwxrwxr-x 6 root root 4,0K Июл 29 12:18 .. drwx------ 6 imap mail 4,0K Авг 23 14:28 Administrator But, as you can see, Administrator's box was created by dovecot with 600 permissions. I am unable to enforce dovecot to create mailboxes with 660 permissions. Output of dovecot -n is in the attachment. Please tell me what's the right way to control mailbox permissions ? -- С уважением, Бажов Вадим, Инженер отдела технической поддержки, Компания «Айдеко» -- Телефоны: +7 (495) 987-32-70; +7 (495) 662-87-34 (тех. поддержка); +7 (343) 220-77-55; Факс: +7 (343) 220-77-85 Электронная почта: Вопросы по приобретению: sales(a)ideco.ru Технические вопросы: support(a)ideco.ru Сайт: http://ideco.ru Форум: http://forum.ideco.ru

2 3

Re: user data transfer when migrating to new server
by Joseph Tam 24 Aug '17

24 Aug '17

voytek(a)sbt.net.au writes: > I've tried imapsync, that seems to work well, but, what options do I have > for doing accounts or domains where I don't know user's password ? It depends on whether you're copying from an existing dovecot you control, but you can use the master password extension user={user}*{masterid}, password={masterppassword} in place of {user}/{userpasswqord} for imapsync to get the job done. Joseph Tam <jtam.home(a)gmail.com>

1 0

store into mailbox 'Junk' aborted
by kenneth topp 23 Aug '17

23 Aug '17

Hi, I've just switch from procmail to pigeonhole, and I'm seeing an issue (twice in six hours). I have spamassisn running via postfix milter, and dropping off via main.cf "mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp" The issue is that I get a sequence of these log messages: Aug 21 19:43:59 lmtp(toppk): Debug: Junk: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: $MAILDIR/Junk: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: copying Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: virtual size (Cache file is unusable) Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: store into mailbox 'Junk' aborted Aug 21 19:43:59 lmtp(toppk): Debug: INBOX: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: copying Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: stored mail into mailbox 'INBOX' Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: Execution of script /home/toppk/.dovecot.sieve failed, but implicit keep was successful (user logfile /home/toppk/.dovecot.sieve.log may reveal additional details) and in /home/toppk/.dovecot.sieve.log I get this: sieve: info: started log at Aug 21 19:43:59. error: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: failed to store into mailbox '$MAILDIR/Junk': Mailbox doesn't exist: $MAILDIR/Junk. So instead of the email going into mbox /home/toppk/mail/Junk it goes into INBOX (/var/mail/toppk). I'm watching the Junk to see if is removed for even a split second and I don't see that. I'm not sure how to further track this down, or if there is a more optimal configuration (i'd prefer to stay mbox if possible). I was thinking of turning on mailbox_list_index. Below is the full doveadm -n output. Any guidance or suggestions welcome. Ken # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.12.4-300.fc26.x86_64 x86_64 Fedora release 26 (Twenty Six) auth_debug = yes auth_username_format = %Ln log_path = /var/log/dovecot.log mail_debug = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/default.sieve } protocols = imap lmtp sieve service auth { unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = mail } user = root } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes protocol lmtp { mail_plugins = " sieve" } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 }

4 4

imapsieve: failed to read mailbox attribute
by Darac Marjal 23 Aug '17

23 Aug '17

Hello all, Hopefully this is something fairly simple. I've been trying to set up the Sieve Antispam system as detailed at https://wiki2.dovecot.org/HowTo/AntispamWithSieve, but at the moment, whenever I change mailboxes I get the following message logged: Aug 22 09:30:45 remy dovecot: imap(darac(a)darac.org.uk): Error: imapsieve: mailbox INBOX: Failed to read /shared/imapsieve/script mailbox attribute and my script does not run when I move files between folders. My sieve files are chmod'ed 0644 and the shell script used to pipe into spamassassin is 0755, so it *should* work, shouldn't it? Is there something I've missed? -- For more information, please reread.

3 4

Patch: acl list from ldap must be possible to have multiple values, that combined in one comma separated list
by DaLiV 23 Aug '17

23 Aug '17

diff to dovecot-2.2.31 hardcoded userdb_acl_groups /as currently not seeing any other fields that need similar way/ in ldap using dynlist - labeledURIObject - some attribute labeledURI :: ldap:///ou=DovecotGroups,dc=DOMAIN,dc=TLD,dc=root?specName?sub?(&(objectclass=posixgroup)(memberuid=XXXXX)) that returns groupnames for each user that he belongs, but as multiple values of same field ... must combine all in one CSV list diff -upbBr src/auth/passdb-ldap.c src/auth/passdb-ldap.c --- src/auth/passdb-ldap.c 2017-06-26 13:29:36.000000000 +0200 +++ src/auth/passdb-ldap.c 2017-08-22 09:56:59.697420441 +0200 @@ -52,13 +52,27 @@ ldap_query_save_result(struct ldap_conne auth_request_set_null_field(auth_request, name); continue; } + if (strcmp(name,"userdb_acl_groups")==0) { + int i = 1; + while (values[i] != NULL) { + strcat(values[0],","); + strcat(values[0],values[i]); + i++; + } + auth_request_log_warning(auth_request,AUTH_SUBSYS_DB, + "Multiple values found for '%s', " + "using combined value '%s'", name, values[0]); + auth_request_set_field(auth_request, name, values[0], + conn->set.default_pass_scheme); + } else { if (values[1] != NULL) { auth_request_log_warning(auth_request, AUTH_SUBSYS_DB, "Multiple values found for '%s', " "using value '%s'", name, values[0]); } auth_request_set_field(auth_request, name, values[0], conn->set.default_pass_scheme); } + } db_ldap_result_iterate_deinit(&ldap_iter); }

2 1

user data transfer when migrating to new server
by voytek＠sbt.net.au 23 Aug '17

23 Aug '17

I;m setting up new server, what are the options for transferring user's mail ? I've tried imapsync, that seems to work well, but, what options do I have for doing accounts or domains where I don't know user's password ? last time I've done, some users had lengthy period of re downloading 'old' mails from new server, is there a way to overcome this ? thanks, V

3 2

v2.2.32 release candidate 2 released
by Timo Sirainen 23 Aug '17

23 Aug '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc2.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc2.tar.gz.sig A couple of changes since rc1: + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor - director: v2.2.31 caused rapid reconnection loops to directors that were down. Also this was already in rc1's list of changes, but wasn't actually in rc1 yet: - dict-ldap: %variable values used in the LDAP filter weren't escaped. Plus a few other smaller fixes.

4 3

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 23 Aug '17

23 Aug '17

Robert Wolf wrote: >> else (NOT LOCALHOST) and you can see it says LOGINDISABLED unless you >> have enabled something like cram-md5. > > Hi, > > exactly, this is the reason, why plain-text is still needed. You don't need > encryption for authentication, if you have secure authentication. Without > knowing original password, the MITM cannot generate correct hash for login, so > the connection can be plain-text. You don't need plaintext to use CRAM-MD5: there's no problem have *both* CRAM-MD5 and SSL (it's overkill, but works). And mail data is worth protecting too. > Of cource, if you then download your emails, the MITM can still read these > emails too, if these emails are plain-text (not encrypted using e.g. SMIME or > GPG). But he cannot misuse your login. No argument here about using end-to-end encryption, but protecting mail data and metadata is important too. Don't forget also, it's not just about the privacy (reading) of mail data, but it's also important to guarantee the authenticity of mail data from tampering. By the way, if we assume a hostile network where MITM is possible, then even closing STARTTLS ports will not guarantee confidential transport: the MITM attacker can merely open up a fake plaintext-only service port, then proxy that to the target server. The client must deny non-secured transport to be fully protected. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 22 Aug '17

22 Aug '17

Lest anyone think STARTTLS MITM doesn't happen, https://threatpost.com/eff-calls-out-isps-modifying-starttls-encryption-com… Not only for security, I prefer port 993/995 as it's just plain simpler to initiate SSL from the get-go rather than to do some handshaking that gets you to the same point. Joseph Tam <jtam.home(a)gmail.com>

7 10

LMTP and Postfix
by Jerry 22 Aug '17

22 Aug '17

I am setting up a new system that will be using Dovecot with Postifx. I am planning on using LMTP. I read the wiki and and found the settings I need to make in Dovecot and the Postfix main.cf file. However, I saw nothing about the Postfix master.cf file. Do I need to make and changes to it also? Thanks -- Jerry

3 2