November 2020 - dovecot

How do Cerbot files map to Dovecot?
by Raymond Herrera 12 Nov '20

12 Nov '20

I am postponing the Apache plugin issue (CentOS is not Certbot friendly) and requesting a standalone, generic certificate. After the command "1: Spin up a temporary webserver" I have the following 2 files in the folder /etc/letsencrypt: -rw-r--r-- 1 root root 924 Nov 12 11:14 csr/0000_csr-certbot.pem -rw------- 1 root root 1708 Nov 12 11:14 keys/0000_key-certbot.pem The "key" is probably a direct replacement for the file in the distribution. What about the "csr" file? It seems to be a request, not the certificate itself. TIA

3 2

Fwd: Trying to install certbot on CentOS
by Raymond Herrera 12 Nov '20

12 Nov '20

On 11/12/2020 10:44 AM, Raymond Herrera wrote: > Following the advice obtained here, I am trying to get a LetsEncrypt > certificate. > > These are the instructions: > > Step 1: > https://snapcraft.io/docs/installing-snapd > > Step 2: > https://certbot.eff.org/lets-encrypt/centosrhel7-apache > > My problem is this error message: > > # snap install --classic certbot > > error: system does not fully support snapd: cannot mount squashfs > image using "squashfs": mount: > /tmp/sanity-squashfs-881328484: failed to setup loop device: No > such file or directory > > Apparently, RedHat/CentOS are not supporters of snap. > > TIA > > OS: CentOS 7 > Thanks to Leonardo and Michael, I have made some progress. The snaps application is not supported by RedHat/CentOS. The solution is simple, just use: # yum install certbot The new error message is this: # certbot certonly --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Could not choose appropriate plugin: The requested apache plugin does not appear to be installed The requested apache plugin does not appear to be installed I am trying to find which is the "requested apache plugin". The log mentions "authenticator". I am hoping that an Apache Certificate will be useful for Dovecot.

2 1

Guide on Renewing SSL Certificate for Apache, Postfix and Dovecot on CentOS 6.8 Linux
by Turritopsis Dohrnii Teo En Ming 12 Nov '20

12 Nov '20

Good day from Singapore, Please check out the following link for my guide. https://marc.info/?l=postfix-users&m=160517863730596&w=2 Thank you very much. -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----

2 1

Trying to install certbot on CentOS
by Raymond Herrera 12 Nov '20

12 Nov '20

Following the advice obtained here, I am trying to get a LetsEncrypt certificate. These are the instructions: Step 1: https://snapcraft.io/docs/installing-snapd Step 2: https://certbot.eff.org/lets-encrypt/centosrhel7-apache My problem is this error message: # snap install --classic certbot error: system does not fully support snapd: cannot mount squashfs image using "squashfs": mount: /tmp/sanity-squashfs-881328484: failed to setup loop device: No such file or directory Apparently, RedHat/CentOS are not supporters of snap. TIA OS: CentOS 7

3 2

Testing
by Turritopsis Dohrnii Teo En Ming 12 Nov '20

12 Nov '20

Testing -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----

1 0

Support TLS for pure remote doveadm commands
by Vincent Brillault 11 Nov '20

11 Nov '20

Dear all, A lot of doveadm commands (e.g. backup/sync, deduplicate, mailbox) support a `-S` (a.k.a `socket-path`) argument that allows to run the command remotely. Unfortunately, I think that there is a bug in the handling of the TLS configuration for this feature. After a bit of debugging, I think it's simply due to doveadm_mail_server_user_get_host (https://github.com/dovecot/core/blob/master/src/doveadm/doveadm-mail-server…) bailing out too quickly: It's used by doveadm_mail_server_user (https://github.com/dovecot/core/blob/master/src/doveadm/doveadm-mail-server…) to set its `user`, `host`, `hostip`, `port` and `ssl_flags`. When doveadm_port is not (or set to 0): - `user` is set to `input->username`: OK - `host` is set to `ctx->set->doveadm_socket_path` (the content of the `-S` option): OK - `hostip` is not set: OK (Later on, the `host` is used in that case) - `port` is set to 0: This is OK, as when the `hostip` (or rather the `server->ip` later in the code) is not set, this is only the default, the port is extracted from the `host` (or rather `server->name`) - `ssl_flags` is not modified: this is not OK as there is nothing else modifying it! Bailing out just a few line later (as in https://patch-diff.githubusercontent.com/raw/dovecot/core/pull/145.patch) fixes the issue for me. To reproduce the issue, with dovecot-2.3.11.3-4, you will need two systems, A & B: A needs to have dovecot configured and port 9091 open in its firewall for B. B just need dovecot to be installed. - Testing without TLS: - Add the following to A's dovecot configuration (and reload it): ``` service doveadm { inet_listener { port = 9091 } } doveadm_password=VeryRandomString ``` - On B, create a file X containing (only): ``` doveadm_password=VeryRandomString ``` - On B, running `doveadm -c X mailbox list -u ${existing_user} -S ${A}:9091` should return the mailbox list - Switching to TLS: - Replace what was added to A's dovecot configuration (and reload it) with: ``` service doveadm { inet_listener { port = 9091 ssl = yes } } doveadm_password=VeryRandomString doveadm_ssl = ssl # Not strictly required ``` - On B, create a file Y containing (only): ``` doveadm_password=VeryRandomString doveadm_ssl=yes ``` - On B, running `doveadm -c Y mailbox list -u ${existing_user} -S ${A}:9091` will not work. - On A, you should see in the logs: `dovecot[16435]: doveadm(${B}): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol` Applying the patch mentioned above makes the 2nd case work. What do you think? Cheers, Vincent

1 0

Re: how to set smtp-client -> submission_relay_host for IPv4 only?
by PGNet Dev 11 Nov '20

11 Nov '20

ref https://dovecot.org/pipermail/dovecot/2020-October/120226.html > On 10/15/20 10:13 PM, Aki Tuomi wrote: >> I'm asking how/where to 'tell', via config, Dovecot's smtp-CLIENT, that's making >> to connection to the submission_relay_host, to use _only_ IPv4. > > > There is currently no (other) way to do this than using /etc/hosts or specifying > IPv4 address for the relay host. Is there a bug request opened for this, then ? Is it planned for implementation ?

1 0

Re: Recovering expunged but not purged e-mails from mdbox with zlib compression
by Aki Tuomi 11 Nov '20

11 Nov '20

> On 10/11/2020 20:07 Daniel Schütze <dms(a)cwa.uk.com> wrote: > > > Dear Aki > Thank you. Unfortunately I'm struggling to get the right syntax for this as it looks like someone else was here too > https://dovecot.org/pipermail/dovecot/2018-July/112441.html > The location in my dovecot.conf is > > mdbox:%%h/mdbox:INDEX=/indexdisk/indexes/%%n:INDEXPVT=~/mdbox/shared/%%n This syntax is for accessing shared folders. You probably should try doveadm -Dv -o mail_location=mdbox_deleted:/path/to/mdbox fetch -u victim text ALL > I'm trying to fetch a message (for testing purposes now) based on it's guid as that is available from doveadm dump. > So my syntax is (based on the previous person who didn't get it to work). > > doveadm -o "mail_location=mdbox_deleted:%%h/mdbox:INDEX=/indexdisk/indexes/%%n:INDEXPVT=~/mdbox/shared/%%n" fetch "body" guid (msg.guid from doveadm dump) > Doveadm does not support var expand, so this will not work. See above for syntax. > But that's getting no response. I've tried putting in the hard path in case there is any trouble with the %%h etc but that doesn't help either. > I've also tried the fetch with the subject of a known deleted message and also adding mailbox Drafts (as I know that's where it is or rather was) but to no avail. > Given doveadm dump gives msg.uid and no subject I'd prefer to use that in any case. > There are no error messages, I do with doveadm was a little more verbose to help over these bumps! > > Any chance of a helping hand? > > > > Aki > > > > Daniel Schütze > Director > > ------------------ > > CWA International Ltd > 5th Floor, 42 Trinity Square > London > EC3N 4DJ > > (t) + 44 (0)20 7242 8444 > (e) dms(a)cwa.uk.com > (w) http://www.cwa.international/ > On 10/11/20 10:53, Aki Tuomi wrote: > > > You can use mdbox_deleted driver to access mails with refcount 0. See > > https://wiki2.dovecot.org/MailboxFormat/dbox > > > > Aki > > > > On 10.11.2020 12.42, Daniel Schütze wrote: > > > > > Yesterday I had to recover an e-mail which a user had deleted. If I > > > understand this correctly the message was expunged but not purged > > > (doveadm purge had not been run). > > > > > > This e-mail was clearly still in the mdbox stored with zlib > > > compression as I could tell using the doveadm dump command (doveadm > > > dump -t dbox filename). > > > > > > I could however not reveal the e-mail with the normal doveadm fetch -u > > > username "body" guid (guid from dump output) > > > > > > In the end I was able to recover the e-mail by cutting it out from the > > > mdbox and running gunzip over it, but this method was very fiddly and > > > would not have worked for a bulk job. I appreciate I could have just > > > deleted the index files and gotten all the deleted messages back by > > > having the index rebuilt but that would have been the proverbial > > > "hammer to crack a nut". > > > > > > Fortunately this e-mail had no attachment for me to worry about, as > > > those are also detached for sis by dovecot. > > > > > > Can anyone tell me of a quick and easy way to recover one or multiple > > > e-mails marked as expunged but not purged which are stored in a mdbox > > > with zlib compression? I'm sure I'll have to do this again the future > > > and my method wouldn't work with a folder! > > > > > > Clearly if I was not using zlib compression I could just have read the > > > contents of the mdbox without any complication. > > > > > > > > > -- > > > Daniel Schütze > > > Director > > > > > > ------------------ > > > > > > CWA International Ltd > > > 5th Floor, 42 Trinity Square > > > London > > > EC3N 4DJ > > > > > > (t) + 44 (0)20 7242 8444 > > > (e) dms(a)cwa.uk.com > > > (w) http://www.cwa.international/ > > >

3 2

Recommended Protocols?
by Raymond Herrera 11 Nov '20

11 Nov '20

Hello all: For several years I have been running the following in a Linux server. Dovecot Version: 2.0.9 *IMAP:* Connection Security: SSL/TLS Port: 993 Authentication Method: Normal Password *SMTP:* Connection Security: STARTTLS Port: 587 Authentication Method: Normal Password The E-mail client is Thunderbird on Windows. I am preparing a new server, with Dovecot 2.2.36 and would like to know the currently recommended protocols. Should I stick to what I have? I would prefer to start with the easiest configuration possible, which I will revise later. This is the command that I have been using to verify the server's functionality: % openssl s_client -connect localhost:imaps TIA

8 13

SSL alert number 42
by Raymond Herrera 11 Nov '20

11 Nov '20

This is a followup to my thread "Recommended Protocols?". The error message is as follows: dovecot: imap-login: Disconnected: TLS: SSL_read() failed: SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 I have selected both SSL/TLS and STARTTLS on the Thunderbird side, with identical results. The first question that I have is this. Is there any way to know whether that error messages comes from an attempt to read: (a) The server SSL certificate? (b) The client SSL certificate? Please find attached 2 log files. I am essentially using the distribution files as they come from the box. TIA

3 6