December 2018 - dovecot

Re: ECDSA client question
by Michael A. Peters 18 Dec '18

18 Dec '18

On 12/16/18 7:52 AM, Tributh via dovecot wrote: > > > Am 16.12.18 um 12:13 schrieb Michael A. Peters: >> Hi, for those who have adopted ECDSA, >> >> Are there still any commonly used IMAPS/POP3S clients that still can not >> handle ECDSA certificates? >> >> I know you can set up Dovecot dor dual cert, I am just trying to >> determine if there still is a real world need to. > > Nearly every client can handle ECDSA, but it depends on the size of the > certificate. > I used years ago ECDSA-384bit certificates, which covered most of the > clients. It came to the point to disable RSA in that time, but than came > Android7.0. This Version can only handle ECDSA-256bit certificates or RSA. > > The coverage of Android7.0 is still over 20%. Google reacted fast and > repaired this bug in 7.1, which is still not coming to most of the phones. > > Cheers > Torsten > Wow - My phone is running Android 6, I just checked with Dad - his phone (Motorola) is running Android 7.0 - the version with the bug. We don't replace phones just because new versions are available, we replace them when they stop working, and when we do we usually get refurbished because we hate how much electronic waste is in the world. I have to admit, the tin foil hat of mine just got an alert. We know there are unexplained constants in the NIST curves including P-256 - what if NSA was partially responsible for this bug (back room deal to avoid anti-trust prosecution, similar deal with IBM was made in the 70s I believe also involving cryptography) so that Android apps that use ECDSA (beyond just the mail client, e.g. chat apps) would use P-256 for compatibility and are maybe vulnerable to MITM for the key exchange. I want Ed25519 now.

2 1

Overrideing pop delete?
by ＠lbutlr 17 Dec '18

17 Dec '18

Is it possible to override the POP3 delete on download command and make sure that messages stay on the server for at least X hours or X days? It is important that the messages be around long enough to hit a snapshot cycle (using rsnapshot to backup ever hour). -- Greedo didn't shoot first, motherfucker!

3 7

Bug in IDLE implementation for virtual mailbox
by Pali Rohár 17 Dec '18

17 Dec '18

Hello! I found bug in Dovecot's IDLE implementation when virtual mailbox is in use. IDLE does not notify about new emails when email appears in newly created mailbox and IDLE was issued in virtual folder which matches "*" wildcard and that mailbox was created after opening virtual mailbox. This problem is present in version 2.2.34 which is available in Debian Stretch system with backports. Reproducer: 1. Create virtual "All" mailbox in Gmail-like style: $ cat All/dovecot-virtual * -Drafts -Spam -Trash ALL 2. Ensure that (real non-virtual) mailbox "Test" does not exist. 3. Create sieve rule which deliver some email to "Test" mailbox. require [ "fileinto", "mailbox" ]; ... fileinto :create "Test"; 4. Open dovecot imap connection, select virtual "All" mailbox and then enter IDLE command. 4. Send email which matches that sieve filter. Email will be processed by dovecot sieve. As "Test" mailbox does not exist, dovecot sieve would first create it and then deliver email into it. Now dovecot imap should notify IDLE client that new message into virtual "All" mailbox was delivered (as it collects emails from all - * - mailboxes). But dovecot for some unknown reason does not notify via IDLE that there is a new email. To get notifications, it is needed to re-open that "All" mailbox again. -- Pali Rohár pali.rohar(a)gmail.com

2 4

Downgrade dovecot if required
by Durga Prasad Malyala 17 Dec '18

17 Dec '18

Hello all, I have version 2.3.3-2 of dovecot and could see version 2.3.4-2 available from the repos. How is feedback after upgrade to 2.3.4-2? Any issues? Can I revert back to older version if I face any problems? Cheers/DP

2 1

ssh_dh?
by Daniel Miller 17 Dec '18

17 Dec '18

Don't know if this was corrected in 2.3.4 (haven't upgraded yet but didn't see it in the notes) - but in 2.3.3 I see this in my log: imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssh_dh=</path/to/dh.pem So...either there's an undocumented feature of SSH-over-IMAP (that's Dovecot - always on the cutting edge!) or someone had a coffee shortage during a coding session... -- Daniel

5 5

Sieve scripts not backed up
by Marc Weustink 17 Dec '18

17 Dec '18

Hi all. I try to backup out sieve scripts through doveadm -o stats_writer_socket_path= backup -R -u marc -N tcp:<remote.host>:4191 All mail is backed up but no scripts. What am I doing wrong ? Thanks Marc doveconf -n # 2.3.4 (0ecbaf23d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 (60b0f48d) # OS: Linux 4.4.0-137-generic x86_64 Ubuntu 16.04.5 LTS autofs # Hostname: xxx dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql-local.conf.ext } doveadm_password = # hidden, use -P to show it mail_debug = yes mail_gid = vmail mail_home = /home/mail/backup/%n mail_location = maildir:/home/mail/backup/%n/mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace Shared { location = maildir:/home/mail/backup/Common/mail:INDEXPVT=/home/mail/backup/%n/mail/common prefix = Shared/ separator = / subscriptions = no type = public } namespace Users { list = children location = maildir:/home/mail/backup/%%n/mail:INDEXPVT=/home/mail/backup/%n/mail/shared/%%n prefix = Users/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = sieve service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = vmail user = vmail } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

2 1

Upgrade to 2.3.1 has failed
by C. Andrews Lavarre 17 Dec '18

17 Dec '18

Problem: We had Dovecot v2.2 working just fine under openSUSE Leap 42.3. But we upgraded openSUSE to Leap 15.0. In the process, Dovecot got upgraded from 2.2 to 2.3.1. It no longer works and I haven't figured out how to downgrade to the older working version. The key issue seems to be the change to requiring dh.pem and changing s sl_protocols to ssl_min_protocols. I think I've navigated both correctly, but it still doesn't work. The error is auth: Error: stats: open(old-stats-user) failed: Permission denied as a consequence of which we get imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: There is no valid PEM certificate. We have followed the instructions at https://wiki.dovecot.org/S SL/DovecotConfiguration 1. We have created /etc/dovecot/dh.pem (yes it took five hours) 2. We have edited 10-ssl.conf as directed by the Wiki: ssl = yes ssl_cert = /etc/certbot/live/privustech.com/fullchain.pem ssl_key = /etc/certbot/live/privustech.com/privkey.pem ssl_dh = /etc/dovecot/dh.pem #(yes, it took five hours to create...) ssl_min_protocol = TLSv1 ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_prefer_server_ciphers = no 3. We have checked 10-ssl.conf against the 2.3 default at https://github.com/dovecot/core/blob/master/doc/example-config/conf.d/10-ss… 4. We do NOT include the less than (<) symbol before the paths because then dovecot fails to load complaining it cannot find the files. 5. we have checked all the pem keys, certificates, and dh files with cat, they all exist and are in the expected hash format. 6. We have followed the instructions to set their permissions root:root 0444 and 0400 accordingly. 7. We have rebooted the host. Any help or clues would be most appreciated. Kind regards, Andy

7 20

ECDSA client question
by Michael A. Peters 16 Dec '18

16 Dec '18

Hi, for those who have adopted ECDSA, Are there still any commonly used IMAPS/POP3S clients that still can not handle ECDSA certificates? I know you can set up Dovecot dor dual cert, I am just trying to determine if there still is a real world need to.

2 1

Plugins mailboxalias subfolders
by Marc Roos 16 Dec '18

16 Dec '18

This plugin does not work anymore when subfolders are created. https://wiki2.dovecot.org/Plugins/MailboxAlias

1 0

mailbox locking
by Victor Sudakov 16 Dec '18

16 Dec '18

Dear Colleagues, I use exim's appendfile transport, procmail and a local mutt on my system, they all (to my knowledge) use lockfiles when working with mboxes. However, `doveconf | grep lock` says dotlock_use_excl = yes lock_method = fcntl mail_max_lock_timeout = 0 mbox_dotlock_change_timeout = 2 mins mbox_lock_timeout = 5 mins mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl pop3_lock_session = no Do I need to change anything in dovecot's default locking setup? Does it still use lockfiles on mboxes or not? There are some contradictory parameters IMHO. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

1 1