November 2023 - dovecot

Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Michael Peddemors 21 Nov '23

21 Nov '23

There is a network claiming to be a security company, however the activity appears to be a little more malicious, and appears to be attempting buffer overflows against POP-SSL services.. (and other attacks). https://www.abuseipdb.com/check/104.156.155.21 Just thought it would be worth mentioning, you might want to keep an eye out for traffic from this company... Might want to make up your own mind, or maybe someone has more information, but enough of a red flag, that thought it warranted posting on the list. Not sure yet if it is Dovecot, or the SSL libraries they are attempting to break, but using a variety of SSL/TLS methods and connections... Anyone with more information? NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

11 15

dovecot and oauth2 (with keycloak) not working
by Francis Augusto Medeiros-Logeay 20 Nov '23

20 Nov '23

Hi, I successfully configured Roundcube to use keycloak for oauth2. However, I am having trouble to make it work with dovecot. My configuration is this: cat dovecot-oauth2.conf.ext tokeninfo_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/userinfo introspection_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/token/intr… introspection_mode = post username_attribute = postfixMailAddress debug = yes scope = openid Roundcube_email This is what I am getting from the logs: Nov 20 08:20:30 auth: Error: ldap(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): ldap_bind() failed: Constraint violation Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host session created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: IPs have expired; need to refresh DNS lookup Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Performing asynchronous DNS lookup Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Submitted (requests left=1) Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: DNS lookup successful; got 1 IPs Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443 (shared): Peer created Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Peer pool created Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Peer created Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Setting up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) (1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Linked queue https://auth.mydomain.com:443 (1 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Started new connection to 10.10.100.10:443 (SSL=auth.mydomain.com) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Making new connection 1 of 1 (0 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connecting Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Waiting for connect (fd=23) to finish for max 0 msecs Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: HTTPS connection created (1 parallel connections exist) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Client connection failed (fd=23) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Connection failed (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Failed to make connection (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Failed to establish any connection within our peer pool: connect(10.10.100.10:443) failed: Connection refused (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) connect(10.10.100.10:443) failed: Connection refused (1 peers pending, 1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Unlinked queue https://auth.mydomain.com:443 (0 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up any connection; failing all queued requests Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Error: 9003 connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Dropping request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Nov 20 08:20:30 auth: Error: oauth2(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): oauth2 failed: connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Destroy (requests left=1) Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Free (requests left=0) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection close Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection disconnect Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Disconnected: connect() failed: Connection refused (fd=23) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Detached peer Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection destroy Nov 20 08:20:32 imap-login: Info: Disconnected (auth service reported temporary failure): user=<francis(a)mydomain.com>, method=XOAUTH2, rip=10.10.40.30, lip=172.18.0.10, TLS, session=<yskzUpAKb9EKCige> My dovecot version is 2.3.7.2 (3c910f64b). I find it odd that it is sending the token as a parameter, when I chose “post” as the introspection mode. But I don’t know if that is the problem. best, Francis

3 6

Avoiding POODLE vulnerability
by Steve Litt 20 Nov '23

20 Nov '23

Hi all, Ten years after the fact I learned about POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerabilities, which enable a poorly configured server to force my client to downgrade to vulnerable encryption. My current conf.d/10-ssl.conf contains the following line: ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL I've read that I should change the preceding line to the following: ssl_protocols = !SSLv3 !SSLv2 Is this correct? For some reason I have the same ssl_cipher_list in dovecot.conf. Should I make the change there too? Is there anything else I need to change? The following is my current dovecot.conf: ================================================= # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # OS: Linux 5.10.12_1 x86_64 # Hostname: mydesk.domain.cxm mail_location = maildir:~/mail/Maildir:INBOX=~/mail/Maildir/.INBOX namespace inbox { inbox = yes location = prefix = } passdb { driver = pam args = %s } userdb { driver = passwd } protocols = imap service imap-login { inet_listener imap { #port = 143 port = 0 } inet_listener imaps { port = 993 #port = 0 ssl = yes #ssl = no } } ssl = required #ssl = yes ssl_cert = </etc/ssl/dovecot_certs/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL ssl_key = </etc/ssl/dovecot_certs/private/dovecot.pem ================================================= By the way, does the preceding dovecot.conf even use the files in directories off conf.d ? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

3 8

passdb doesn't support credential lookups
by Michael Grant 20 Nov '23

20 Nov '23

I'm having trouble authenticating certain users. I see this in the logs: Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Performing passdb lookup Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): passdb doesn't support credential lookups Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Finished passdb lookup at the command line, if I run this: % doveadm auth login jane Password: passdb: jane auth succeeded Oddly, I have a handfull of users that are failing and others that are not and I don't see the difference.

1 0

Re: DMARC Failures for Mailing List
by dovecot＠x9p.org 18 Nov '23

18 Nov '23

On 11/17/23 10:38, Nick Lockheart wrote: > The DKIM check is also failing. I think the list software may be re-writing the > message bodies. I believe one of the reasons for the DKIM failure is this addition/configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email todovecot-leave(a)dovecot.org >>>>>>>> --x9p On 11/17/23 10:38, Nick Lockheart wrote: The DKIM check is also failing. I think the list software may be re- writing the message bodies. I believe one of the reasons for the DKIM failure is this addition/ configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org >>>>>>>> --x9p

1 0

DMARC Failures for Mailing List
by Nick Lockheart 18 Nov '23

18 Nov '23

Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re- writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message. Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re-writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message.

4 3

how to filter in doevecot/lmtp with sieve according to postfix orig_to value
by TSHIMANGA Minkoka 17 Nov '23

17 Nov '23

Dear All, I am managing an email infrastructure running with the below. Rocky Linux 8.7 (Green Obsidian) 4.18.0-425.3.1.el8.x86_64 postfix-3.5.8-4.el8.x86_64 dovecot-2.3.16-3.el8.x86_64 dovecot-pigeonhole-2.3.16-3.el8.x86_64 In reality there are more packages installed and configured. But I limited my enumeration above to what I think is relevant. I will be happy to provide more details if needed and/or requested. Here is my problem, or at least on what I need help/guidance/assistance. I have a virtual alias that forward emails to support(a)example.com to my inbox tshimanga.minkoka(a)example.com. That works fine as I can see those emails in my INBOX. And I want those emails to be moved in INBOX/support with a local sieve rule. For that I have the below that works. # rule:[support] if allof (header :is "to" "support(a)example.com") { fileinto :create "INBOX/support"; } The problem is that the above sieve rule seems not enough to catch email where support(a)example.com is not the "To" fields, as with cases of "Cc:" or "Bcc:". In the log of postfix, I can see lines with "... postfix/lmtp ... orig_to=<support(a)example.com> ...". The problem I am facing is that "orig_to" is not part of the headers postfix/lmtp (in reality dovecot/lmtp process) can see in order to apply on it a sieve rule. Any suggestions on how I can also sieve filter those emails ? Regards, Tshimanga

2 2

auth service over tls
by ibra 17 Nov '23

17 Nov '23

Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing? Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing?

4 5

Re: Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Joseph Tam 16 Nov '23

16 Nov '23

On Wed, 15 Nov 2023, 23:25 Michael Peddemors, <michael(a)linuxmagic.com> wrote: > Not sure yet if it is Dovecot, or the SSL libraries they are > attempting > to break, but using a variety of SSL/TLS methods and connections... > > They are not interested in dovecot per se. They scan for TLS vulnerabilities, > mostly. They're running comprehensive port scans, so they're targeting more than just SSL services. > OrgName: Academy of Internet Research Limited Liability > Company > OrgId: AIRLL > Address: #A1- 5436 > Address: 1110 Nuuanu Ave > City: Honolulu > StateProv: HI > PostalCode: 96817 > Country: US Out of business virtual offices, naturally. AIRLL also operating out of 195.96.137.0/24. Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: auth service over tls
by ibra 16 Nov '23

16 Nov '23

I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: > > Are Postfix and Dovecot running on the same server? If so, you might be > better served by connecting with a UNIX socket rather than TCP. > > I'm not sure there is much security benefit to using TLS on the loopback > interface which is what was in your example from the previous email. > > And to clarify, Postfix supports TLS for authentication between an email > program like Thunderbird and the Postfix server, but does not support TLS > for the SASL AUTH *service* connection from Postfix to the AUTH provider > (Dovecot or Cyrus-SASL). > > Also, please use the group reply function so your email goes to the list, > this email only went to me. > > > On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: > > Good Morning, > thank you for your fast response, and sorry to not answer before, I forgot > to check spam folder. Good to know that postfix does not support SASL AUTH > over TLS, because actually I was planning to use it. > I started with Dovecot to check if auth port support tls. For that I > launched tls handshake using openssl, like this command: > $ openssl s_client -servername mail.sample.com -connect localhost:12345 > > But I got an error. (In summary Dovecot ends the connection). > Anyway, it would be awesome that in the future both Postfix and Dovecot > could support it. > > > On LMTP port, tls handshake worked in Dovecot side, now I have to > configure Postfix to make the request to dovecot LMTP over tls. > > With Postfix I was able to send data to Dovecot LMTP port, but was not > over TLS. Do you know what settings should I enable in Postfix side? > > Regards > Ibra. > > > On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> > wrote: > > On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: > > Hi, > I'm trying running tls connections for both auth and lmtp services. For > lmtp it is ok, for auth service I couldnt make it. I configure dovecot with > the next configuration in file "conf.d/10-myconfig.conf": > > > Which MTA are you trying to connect from? Postfix does not support SASL > AUTH over TLS, for example. > > > I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: Are Postfix and Dovecot running on the same server? If so, you might be better served by connecting with a UNIX socket rather than TCP. I'm not sure there is much security benefit to using TLS on the loopback interface which is what was in your example from the previous email. And to clarify, Postfix supports TLS for authentication between an email program like Thunderbird and the Postfix server, but does not support TLS for the SASL AUTH *service* connection from Postfix to the AUTH provider (Dovecot or Cyrus-SASL). Also, please use the group reply function so your email goes to the list, this email only went to me. On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: Good Morning, thank you for your fast response, and sorry to not answer before, I forgot to check spam folder. Good to know that postfix does not support SASL AUTH over TLS, because actually I was planning to use it. I started with Dovecot to check if auth port support tls. For that I launched tls handshake using openssl, like this command: $ openssl s_client -servername mail.sample.com -connect localhost:12345 But I got an error. (In summary Dovecot ends the connection). Anyway, it would be awesome that in the future both Postfix and Dovecot could support it. On LMTP port, tls handshake worked in Dovecot side, now I have to configure Postfix to make the request to dovecot LMTP over tls. With Postfix I was able to send data to Dovecot LMTP port, but was not over TLS. Do you know what settings should I enable in Postfix side? Regards Ibra. On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> wrote: On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/ 10-myconfig.conf": Which MTA are you trying to connect from? Postfix does not support SASL AUTH over TLS, for example.

1 0