December 2018 - dovecot

Upgrade to 2.3.1 has failed
by C. Andrews Lavarre 17 Dec '18

17 Dec '18

Problem: We had Dovecot v2.2 working just fine under openSUSE Leap 42.3. But we upgraded openSUSE to Leap 15.0. In the process, Dovecot got upgraded from 2.2 to 2.3.1. It no longer works and I haven't figured out how to downgrade to the older working version. The key issue seems to be the change to requiring dh.pem and changing s sl_protocols to ssl_min_protocols. I think I've navigated both correctly, but it still doesn't work. The error is auth: Error: stats: open(old-stats-user) failed: Permission denied as a consequence of which we get imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: There is no valid PEM certificate. We have followed the instructions at https://wiki.dovecot.org/S SL/DovecotConfiguration 1. We have created /etc/dovecot/dh.pem (yes it took five hours) 2. We have edited 10-ssl.conf as directed by the Wiki: ssl = yes ssl_cert = /etc/certbot/live/privustech.com/fullchain.pem ssl_key = /etc/certbot/live/privustech.com/privkey.pem ssl_dh = /etc/dovecot/dh.pem #(yes, it took five hours to create...) ssl_min_protocol = TLSv1 ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_prefer_server_ciphers = no 3. We have checked 10-ssl.conf against the 2.3 default at https://github.com/dovecot/core/blob/master/doc/example-config/conf.d/10-ss… 4. We do NOT include the less than (<) symbol before the paths because then dovecot fails to load complaining it cannot find the files. 5. we have checked all the pem keys, certificates, and dh files with cat, they all exist and are in the expected hash format. 6. We have followed the instructions to set their permissions root:root 0444 and 0400 accordingly. 7. We have rebooted the host. Any help or clues would be most appreciated. Kind regards, Andy

7 20

ECDSA client question
by Michael A. Peters 16 Dec '18

16 Dec '18

Hi, for those who have adopted ECDSA, Are there still any commonly used IMAPS/POP3S clients that still can not handle ECDSA certificates? I know you can set up Dovecot dor dual cert, I am just trying to determine if there still is a real world need to.

2 1

Plugins mailboxalias subfolders
by Marc Roos 16 Dec '18

16 Dec '18

This plugin does not work anymore when subfolders are created. https://wiki2.dovecot.org/Plugins/MailboxAlias

1 0

mailbox locking
by Victor Sudakov 16 Dec '18

16 Dec '18

Dear Colleagues, I use exim's appendfile transport, procmail and a local mutt on my system, they all (to my knowledge) use lockfiles when working with mboxes. However, `doveconf | grep lock` says dotlock_use_excl = yes lock_method = fcntl mail_max_lock_timeout = 0 mbox_dotlock_change_timeout = 2 mins mbox_lock_timeout = 5 mins mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl pop3_lock_session = no Do I need to change anything in dovecot's default locking setup? Does it still use lockfiles on mboxes or not? There are some contradictory parameters IMHO. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

1 1

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 11:06 Tributh <dovecot-user(a)tributh.net> wrote: > > > > > Am 16.12.18 um 09:42 schrieb Aki Tuomi: > > > >> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi, > >> is that here the right place to make feature requests? > >> > >> dovecot supports as authentication mechanism > >> SCRAM-SHA-1 from RFC 5802 > >> which was updated to > >> SCRAM-SHA-256 in RFC 7677 > >> > >> Can SCRAM-SHA-256 be added to the authentication mechanisms? > >> > >> I would not like to request, that SCRAM-SHA-1 will be exchanged by > >> SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > >> > >> Regards > >> > >> Torsten > > > > Hi! > > > > Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? > > > > Aki > > > Hi Aki, > let me first answer the second question. > Sadly I have no client which supports it, yet. > Here we have a chicken or the egg causality dilemma. > There was some communication with mail-client developers which stated > that they would start developing it, when they have a publicly usable > server to test against. > Now I hope that the most common IMAP server could be the one, which > gives this possibility. > Sadly, most communication is not publicly available. > > In the past CRAM-MD5 was very popular. When the insecurity came out, > everything just shifted to TLS, but that prevented not from sending a > plain password now. If a malicious actor is able to change DNS/TLS > endpoints, he will receive the plain passwords immediately. > I am not the expert in explaining how such an actor could do this. I > just wanted to have possibilities for everybody to prevent this possible > exposure of a plain password, which could than easily used abusively. > > I just hope for better security in the future. > > Regards Torsten > > We'll see if this could be added. Aki

1 0

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi, > is that here the right place to make feature requests? > > dovecot supports as authentication mechanism > SCRAM-SHA-1 from RFC 5802 > which was updated to > SCRAM-SHA-256 in RFC 7677 > > Can SCRAM-SHA-256 be added to the authentication mechanisms? > > I would not like to request, that SCRAM-SHA-1 will be exchanged by > SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > > Regards > > Torsten Hi! Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? Aki

2 1

Feature request SCRAM-SHA-256
by Tributh 16 Dec '18

16 Dec '18

Hi, is that here the right place to make feature requests? dovecot supports as authentication mechanism SCRAM-SHA-1 from RFC 5802 which was updated to SCRAM-SHA-256 in RFC 7677 Can SCRAM-SHA-256 be added to the authentication mechanisms? I would not like to request, that SCRAM-SHA-1 will be exchanged by SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 Regards Torsten

1 0

[Fwd: Re: Upgrade to 2.3.1 has failed]
by C. Andrews Lavarre 16 Dec '18

16 Dec '18

Alexander hi. Aki caught the STARTTLS issue as well, I corrected it, but it still doesn't work. Enjoy your weekend. I intend to enjoy mine! :-) Thanks again for your time. Andy -------- Forwarded Message -------- From: C. Andrews Lavarre <alavarre(a)gmail.com> To: Aki Tuomi <aki.tuomi(a)open-xchange.com> Subject: Re: Upgrade to 2.3.1 has failed Date: Sat, 15 Dec 2018 15:08:58 -0500 Aki thank you again. If you and Alexander are stumped then surely I am too! I swear I didn't change anything, and indeed have tried going back to the backup of 10- ssl.conf, which worked under 2.2, but doesn't under 2.3 even after making the changes described in the upgrade documentation. All I did was change all the repositories to Leap 15.0 from Leap 42.3 and execute zypper dup. It took several hours to complete at which point everything works just fine, except that Dovecot was upgraded from 2.2.xxx? to 2.3.1 without my even agreeing to it... :-( This version 2.3.1 is the openSUSE repository offering for their Leap 15.0. I tried finding a rollback version yesterday—2.2.3, 2.2.9... I don't need all the bells and whistles, I just want it to work—but all had one kind of dependency hell or another... :-( What I've done in the meantime is to mount /home/alavarre/Maildir with sshfs, and then point KMail at it, so I can read and write email without dovecot, but it would be nice to fix it IDC... So maybe the right answer is to try the latest, perhaps in Tumbleweed... I'm usually allergic to self-compiling, I alway seem to find one dependency hell or another, but I'll go ahead and try anyhow. I'll let you know. In the meantime all the failed logins have put me in jail by the provider (Cox Cable) accusing me of being a spammer... :-( But for now I'll go have a gin and tonic and hit it again tomorrow... :-) Enjoy your weekend, and thank you again for your thoughts and time. Cheers, Andy On Sat, 2018-12-15 at 21:37 +0200, Aki Tuomi wrote: > There is still something wrong with your config. Btw if you are > compiling yourself you might want to use 2.3.4 > > We test the cert functionality in our ci tests so I am fairly > confident this is not a dovecot bug. > > Aki > >

1 0

Multiple SSL certs in a virtual Domain hosting environment
by The Doctor 15 Dec '18

15 Dec '18

I am trying to get this correct. ---------------- configuration ------------ # 2.0.0: dovecot.conf auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug=yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = imap pop3 lmtp service auth { executable = /usr/dovecot2/libexec/dovecot/auth user = root } service imap-login { chroot = login client_limit = 256 inet_listener imap { address = 204.209.81.1, 127.0.0.1 port = 143 } inet_listener imaps { address = 204.209.81.1, 127.0.0.1 port = 993 ssl = yes } executable = /usr/dovecot2/libexec/dovecot/imap-login process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot ##vsz_limit = 1M } service imap { executable = /usr/dovecot2/libexec/dovecot/imap process_limit = 512 ##vsz_limit = 256 } ssl = yes ssl_cert = <//etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wilcard.nk.ca.2018.key verbose_ssl = yes ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap local_name imap.acebizventures.com { ssl_cert = </etc/ssl/certs/wildcard.acebizventures.com.2019.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wildcard.acebizventures.com.2019.key } ssl_cert = </etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL ssl_key = </etc/ssl/certs/wilcard.nk.ca.2018.key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes } plugin { home=/usr/dovecot2 } service pop3-login { chroot = login client_limit = 256 inet_listener pop3 { address = 204.209.81.1 port = 110 } inet_listener pop3s { address = 204.209.81.1 port = 995 ssl = yes } executable = /usr/dovecot2/libexec/dovecot/pop3-login process_limit = 128 process_min_avail = 4 service_count = 1 user = dovecot } service pop3 { executable = /usr/dovecot2/libexec/dovecot/pop3 process_limit = 512 } protocol pop3 { pop3_no_flag_updates = yes pop3_enable_last = yes pop3_reuse_xuidl = yes pop3_lock_session = no pop3_uidl_format = %08Xu%08Xv pop3_save_uidl = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s mail_max_userip_connections = 3 mail_plugins = $mail_plugins pop3_client_workarounds = outlook-no-nuls oe-ns-eoh ## oe6-fetch-no-newmail local_name pop3.acebizventures.com { ssl_cert = </etc/ssl/certs/wildcard.acebizventures.com.2019.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wildcard.acebizventures.com.2019.key } ssl_cert = </etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL ssl_key = <//etc/ssl/certs/wilcard.nk.ca.2018.key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes } service lmtp { process_min_avail = 5 inet_listener lmtp { address = 204.209.81.1 127.0.0.1 port = 24 } executable = lmtp -L unix_listener lmtp { } } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log # use %Ln to strip away the domain part auth_username_format = %Lu } } End configuration. Is it possible to listen on a A.B.C.0/24 ? Anything else to get virtual multiple SSLs to work? Unique domains on each SSL. -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Merry Christmas 2018 and Happy New Year 2019!!

1 0

Downloading e-mail from a master mail server
by R. Diez 14 Dec '18

14 Dec '18

Hi all: I am trying to migrate a small company from Microsoft Exchange / Outlook to Thunderbird. I am evaluating e-mail server software. We have an Internet provider that we do not really want to rely upon. We also do not have the resources to maintain a mail server visible from the outside, especially regarding security updates. Each employee has an e-mail account on our current Internet provider, and one e-mail account on our internal Exchange Server. Our Exchange server periodically downloads all e-mails from the Internet provider mailboxes to its local mailboxes. Therefore, employees cannot access their e-mails when travelling. We have worked this way for years without problems. There are other ways, like VPN access etc, but we do not have the resources to install or maintain more IT stuff. So I would like to keep this setup, with one important difference: e-mails on the Internet provider mailboxes should remain there for a couple of weeks. This is similar to Thunderbird's option "Leave a copy on server" together with "For at most xx days". This way, employees could access at least their most recent e-mails when travelling, if only over the Internet provider's web interface. I could achieve such a setup without a local mail server at all, only with the Thunderbird clients, but I have not figured out yet how to automatically backup all mailboxes. See this question of mine: https://support.mozilla.org/en-US/questions/1243605 So I am trying to design a solution with Dovecot, but I know too little about mail servers. How could I configure Dovecot / MTAs / whatever in order to achieve the "Leave a copy on server" together with "For at most xx days" mentioned above? This way, Dovecot does not need to be exposed on the Internet. Failing that, could someone tell me at least how to configure Dovecot / whatever to download the external IMAP mailboxes to the internal IMAP mailboxes? When I read about Postfix and the like, I see SMTP and e-mail queues, but that's not what I need. This guy wants a similar setup: https://serverfault.com/questions/500591/fetch-all-mail-from-an-imap-server… But I did not understand the Fetchmail part, which seems to be discouraged anyway: "Fetchmail can be used as a POP/IMAP-to-SMTP gateway for an entire DNS domain, collecting mail from a single drop box on an ISP and SMTP-forwarding it based on header addresses. (We don't really recommend this, though, as it may lose important envelope-header information. ETRN or a UUCP connection is better.)" I also haven't understood yet the backup part with Dovecot. There is no central e-mail database like in Microsoft Exchange, right? How do I backup all mailboxes for all users? I probably need to stop the Dovecot server an any MTAs before backing the raw files underneath, right? Many thanks in advance, rdiez

2 1