August 2017 - dovecot

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 22 Aug '17

22 Aug '17

Lest anyone think STARTTLS MITM doesn't happen, https://threatpost.com/eff-calls-out-isps-modifying-starttls-encryption-com… Not only for security, I prefer port 993/995 as it's just plain simpler to initiate SSL from the get-go rather than to do some handshaking that gets you to the same point. Joseph Tam <jtam.home(a)gmail.com>

7 10

LMTP and Postfix
by Jerry 22 Aug '17

22 Aug '17

I am setting up a new system that will be using Dovecot with Postifx. I am planning on using LMTP. I read the wiki and and found the settings I need to make in Dovecot and the Postfix main.cf file. However, I saw nothing about the Postfix master.cf file. Do I need to make and changes to it also? Thanks -- Jerry

3 2

Disconnected in APPEND depends on service_count?
by Hajo Locke 22 Aug '17

22 Aug '17

Hello, we have quite odd behaviour of dovecot under new OS. We use dovecot 2.2.18 for years under Ubuntu12 and Ubuntu14. Now we use Ubuntu16 and notice some strange errors. dovecot 2.2.18 is rather old, but runs reliable and we dont need newest features, so we packaged it again on Ubuntu16. For explanation: We use some own patches for dovecot and insert some functions in deb packages, so we want to reuse our code to minimize effort. Under ubuntu16 we see a lot of messages like this on high load servers: Aug 22 08:28:15 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 0 secs, 8192/136342 bytes) in=8379 out=830 Aug 22 08:28:16 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 0 secs, 8192/136342 bytes) in=8985 out=2931 Aug 22 08:42:58 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 29 secs, 13139969/42801634 bytes) in=13140054 out=404 Aug 22 08:43:01 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 3 secs, 1286145/42801634 bytes) in=1286230 out=404 Aug 22 08:43:29 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 2 secs, 704476/42801634 bytes) in=704561 out=404 Aug 22 08:44:29 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 60 secs, 27402241/42801634 bytes) in=27402326 out=404 Aug 22 08:45:30 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 3 secs, 1458177/42801634 bytes) in=1458262 out=404 Aug 22 08:46:15 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 45 secs, 20594652/42801634 bytes) in=20594737 out=404 Aug 22 08:47:38 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 11 secs, 4907009/42801634 bytes) in=4907094 out=404 Error occured after sending a mail, when client tries to save sent mail in sent-messages folder. (mbox) Typically this is a client problem caused by firewall/virusguard or network erros. But we saw that many different users are effected and we could reproduce this behaviour on clean clients. In our logs and systemd journal we had no hints leading to other error-messages, no dovecot message which tells that limit xy was reached. Also no hints for other malfunctioning services. No helpful lines with mail_debug=yes We tried a lot and it seems that changing "service_count = 0" to "service_count = 1" is part of solution. After changing and restarting the behaviour is like expected. old: service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 1 service_count = 0 user = dovecot } new: service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 1 service_count = 1 user = dovecot process_limit = 10000 } service_count switches between number of handled client-connections. i dont see a relation between service_count and the permanent disconnects but it seems to be part of problem. Can anybody explain this behaviour or give some handy tips? Thanks, Hajo

1 0

Re: pop 110/995, imap 143/993 ?
by Robert Wolf 22 Aug '17

22 Aug '17

On Tue, 22 Aug 2017, Ivan Warren wrote: > Le 8/22/2017 à 10:03 AM, Robert Wolf a écrit : > > > > WRONG!!! The email is stored plain-text on the first server and then it can > > be > > sent to other few MX servers over plain-text connection. I.e. encrypted > > connection does not protect emails, but the authentication credentials. > > > > > Indeed. > > Encrypted (SSL/TLS) SMTP/IMAP/POP3 sessions only server 1 purpose : To encrypt > authentication. Once a message is sent through a MTA, there is no guarantee of > privacy whatsoever. > > End to End privacy can only be achieved through actual e-mail signing and > encryption (PGP, S/MIME) (but only the message body is encrypted, not the > headers). Hello Ivan yes, headers are not encrypted in plain-text SMTP, the same way as TCP and IP and DNS Requests are not encrypted. One can only hide behind some anonymization system (TOR, Proxy, VPN for TCP, IP, DNS) or some non-presonal mail system to anonymize mail headers to not be able to connect real persones with mail sender/recipient. Regards, Robert.

1 0

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 21 Aug '17

21 Aug '17

Gary <lists(a)lazygranch.com> writes: > If I read this correctly, starttls will fail due to the MITM attack. > That is the client knows security has been compromised. I'm not sure what you man by "fail". STARTTLS is prone to MITM attacks if a client has not been configured to refuse non-STARTTLS/SSL sessions. For clients that will allow both secured and plaintext session (like most MTAs), an attacker can strip out the server's STARTTLS capability declaration and fool the client into using an unencrypted session. > Using SSL/TLS, the MITM can use SSL stripping. Since most Postifx conf > use "may" for security, the message would go though unencrypted. > Correct??? If it's what I described above, then yes. > Is there something to enable for perfect forward security with starttls? PFS is enabled using a particular choice of encryption algorithms (in particular, use of ephememeral keys algorithms like ECDHE-*), but this happens after SSL initiaton, whether by STARTTLS, or by connection to SSL ports. Joseph Tam <jtam.home(a)gmail.com>

1 0

Domain without certificate
by Andreas Meyer 21 Aug '17

21 Aug '17

Hello! I have a new domain integrated into dovecot but no certificate yet. In dovecot.conf there is ssl = yes and the other domains have certificates configured. How do I exclude this new domain from using SSL? Greetings Andreas

1 1

pop 110/995, imap 143/993 ?
by voytek＠sbt.net.au 21 Aug '17

21 Aug '17

just setting a new Dovecot server to migrate from older system, but, I have a general question: 1. I've set the server with self issued cert, and both pop/imap StartTLS/110/143 SSL/993/995 (apologies if I'm using wrong naming terminology) is there a 'preferred way'? should I tell users to use 143 over 993 ? or 993 over 143? or? my current understanding is that some (MS?) clients might not support StartTLS/143 ? so best to offer both ? I think? some public WiFi block 993/995 but allow 143/110, hence, another advantage for using 143/110 thanks for any advice, V

6 11

Permission denied to access the email file
by ATHANASE Jean-René 21 Aug '17

21 Aug '17

Hi, Dovecot version : 2.2.22 (fe789d2) Operating system : DISTRIB_ID=Ubuntu DISTRIB_RELEASE=16.04 DISTRIB_CODENAME=xenial DISTRIB_DESCRIPTION="Ubuntu 16.04.2 LTS" CPU architecture : Linux 4.4.67-1-pve #1 SMP PVE 4.4.67-92 (Fri, 23 Jun 2017 08:22:06 +0200) x86_64 GNU/Linux FIle system : local UID GID Aug 17 11:47:28 azizee dovecot: imap(jra11[*5063*:*5011*]): Debug: Effective uid=5063, gid=5011, home=/var/spool/domaines/vitalnet/jra/ Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/spool/domaines/vitalnet/jra/ Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): Debug: maildir++: root=/var/spool/domaines/vitalnet/jra, index=, indexpvt=, control=, inbox=/var/spool/domaines/vitalnet/jra, alt= Aug 17 11:47:28 azizee dovecot: imap(jra11[5063:5011]): *Error*: open(/var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,) failed: *Permission denied* (euid=*5063*(<unknown>) egid=*5011*(<unknown>) missing +r perm: /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,) Ldap configuration : user_attrs = uid=user,userPassword=password,homeDirectory=home,uidNumber=uid,gidNumber=gid ll /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\, -rw------- 1 5095 5011 438 Aug 16 15:29 /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2, If I set with the command line "chmod g=rw /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\,", this file email is treated by Dovecot, per example, i have deleted it. ll /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee\:2\,ST -rw-rw---- 1 5095 5011 438 Aug 16 15:29 /var/spool/domaines/vitalnet/jra/cur/1502890181.V704I34050fM371072.azizee:2,ST What's the problem of my configuration ? Best regards,

2 1

ot: self certified enduser browser/mail client install?
by voytek＠sbt.net.au 21 Aug '17

21 Aug '17

I have self certified Dovecot as so: ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } in order for end user to avoid webmail warnings or email client warnings, do I make this file /etc/pki/dovecot/certs/dovecot.pem available to users say under httpd://webhost/tld/certificate/dovecot.pem and, tell users to import dovecot.pem (from /etc/pki/dovecot/certs/dovecot.pem) into their PC/browser/mailclient certs? (sorry for dumb Q, but I thought I should ask before I commit some fundamental stuffup)

3 2

Re: is a self signed certificate always invalid the first time
by Joseph Tam 20 Aug '17

20 Aug '17

Michael Felt <michael(a)felt.demon.nl> writes: >> I use acme.sh for all of my LetsEncrypt certs (web & mail), it is >> written in pure shell script, so no python dependencies. >> https://github.com/Neilpang/acme.sh > > Thanks - I might look at that, but as Ralph mentions in his reply - > Let's encrypt certs are only for three months - never ending circus. I wouldn't characterize it as a circus. Once you bootstrap your first certificate and install the cert-renew cron script, it's not something you have to pay a lot of attention to. I have a few LE certs in use, and I don't think about it anymore: it just works. The shorter cert lifetime also helps limit damage if your certificate gets compromised. Joseph Tam <jtam.home(a)gmail.com>

10 14