July 2023 - dovecot - dovecot.org

argon2id best practices, generating and database storage
by David Mehler 12 Jul '23

12 Jul '23

Hello, To users of argon2id as a password hash, what are best practices/what do you use to generate the argon2id password hashes? I want to know if I should do more than: doveadm pw -s ARGON2ID Also, for storing an argon2id password hash in a database (mysql/mariadb in this example) what value(s) do you use for the field? Thanks. Dave.

1 0

Motion for OCSP Support in Dovecot
by novoMedia 12 Jul '23

12 Jul '23

Currently, Dovecot does not offer any support for OCSP, leaving system administrators with a dilemma: choosing between security or compatibility. - What is OCSP? OCSP (Online Certificate Status Protocol) is a network protocol used to check the validity and revocation status of digital certificates in real-time. - What is Must-Staple? "Must-Staple" is a certificate extension that enforces the inclusion of OCSP stapling information, requiring servers to present the certificate's revocation status during the TLS handshake. - What advantages does the use of Must-Staple offer? The inclusion of a 'must-staple' flag in a certificate mandates the presence of an OCSP response during a TLS handshake, ensuring that a revoked certificate remains (at worst) only usable until the expiration of the latest OCSP response, rather than the expiration of the certificate itself (subject to specific client/implementation). https://www.reddit.com/r/selfhosted/comments/aye79v/the_case_for_ocsp_musts… - What is the current issue with Dovecot? Presently, any system administrator who intends to issue must-staple certificates, faces the dilemma to either chose to a) Refrain from issuing must-staple certificates at all, resulting in the loss of a valuable security feature. b) Issue must-staple certificates without an OCSP response in Dovecot, thereby breaking the TLS RFC (and “hope for the best” on the client side…). A "stuck between a rock and a hard place" situation. - Any other reasons to implement OCSP? Regulatory frameworks such as HIPAA, PCI-DSS and more require the implementation of OCSP to enhance privacy and security. Personally, this requirement does not impact me since I am neither located in the United States nor have customers there. Nonetheless, it is worth noting this requirement for individuals or entities who are subject to these regulations. - Is there demand for OCSP in Dovecot? https://github.com/mjhas/dovecot/issues/44 (First GitHub Google hit for “dovecot ocsp”) https://serverfault.com/questions/830434/do-postfix-and-dovecot-support-ocs… https://dovecot.org/pipermail/dovecot/2018-October/113368.html https://www.dovecot.org/list/dovecot/2016-March/103395.html - Summary By implementing a simple OCSP solution, Dovecot could effectively solve this predicament without any drawbacks for its users. The focus here is on simplicity. It is unnecessary to employ a comprehensive OCSP resolver/responder like the one used in Nginx; rather, it would suffice to allow the definition of a simple file path containing the OCSP response alongside the certificate (honoring TLS SNI). Please kindly consider my motion.

4 6

mail-crypt key sharing
by Robert Senger 12 Jul '23

12 Jul '23

Hi all, I am trying to setup mailbox sharing (not public mailboxes) together with mail-crypt plugin and encrypted folder keys. According to the source code of the mail-crypt plugin (there's code trying to retrieve private keys for shared mailboxes), and its documentation, this should be possible: ----- If you are using global keys, mails can be shared within the key scope. The global key can be provided with several different scopes: Global scope: key is configured in dovecot.conf file Per-user(group) scope: key is configured in userdb file With folder keys, key sharing can be done to single user, or multiple users. When key is shared to single user, and the user has public key available, the folder key is encrypted to recipient’s public key. If you have mail_crypt_acl_require_secure_key_sharing enabled, you can’t share the key to groups or someone with no public key. ----- The documentation mentions key sharing, but I have no idea how this could be implemented, and did not find anything else than this mail- crypt documentation in the whole web... I assume that I need to export the user key of the users's folder that should be shared, and import it into the receiving users keys, encrypted with the receiving user's key. Is that right? Any hints how to do that? Regards, Robert -- Robert Senger

1 2

Shared folders?
by joe a 11 Jul '23

11 Jul '23

Is it possible to setup shared folders between virtual users on the same server?

5 9

Public mailboxes and mailcrypt
by Robert Senger 11 Jul '23

11 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

3 3

How to disable BINARY extension
by Ralf Becker 10 Jul '23

10 Jul '23

Reason for disabling are many broken mails containing unescaped equal signs ("=") and our webmailer is using BINARY, when offered, and than does not display the mail and reports Dovecots error "Invalid quoted-printable input trailer: '=' not followed by two hex digits". I'm fully aware that the mails are broken, unfortunately all sorts of programs or senders generate them ... I can use imap_capability = <full-list-of-caps-without-binary> but this is for multiple reasons not ideal: - new caps would never show up - pre-login the are also displayed There seems to be no syntax like: imap_capability = -BINARY Is there any other way to disable just binary? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

meaning of LIST output
by joe a 10 Jul '23

10 Jul '23

having trouble using offlineimap to copy folders to a local store for spamassasin to use. Says "no folder to sync (folderfilter issue?)" Thinking I simply did not know the proper folder name, did telnet to dovecot server for list of folders, see this,(snippet): . . . * LIST (\HasNoChildren \UnMarked) "." Cabinet.Missed-SPAM * LIST (\HasNoChildren) "." Cabinet.Missed-HAM * LIST (\HasNoChildren \UnMarked) "." Cabinet.Marked-SPAM . . . What is the significance of not one being not "UnMarked"? joe a.

1 0

rename virtual user?
by joe a 09 Jul '23

09 Jul '23

Possible to change a virtual user account, in passwd file, to another name and or domain?

3 3

Public mailboxes and mailcrypt
by Robert Senger 09 Jul '23

09 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

1 0

Fwd: dovecot and postfix, authentication issue
by jeremy ardley 06 Jul '23

06 Jul '23

On 6/7/23 20:49, joe a wrote: > On 7/6/2023 8:12 AM, jeremy ardley via dovecot wrote: >> >> On 6/7/23 19:15, joe a wrote: >>> >>> If your example was meant to show the correct way, I cannot see any >>> difference between that and what my posted config shows other than >>> the sequential (contiguous?) in your example. >> >> Perhaps try the different configuration out? Or even better, stick to >> one auithentication method only. >> >> >> Jeremy >> > > Sorry, not to appear dense or argumentative, but I did not see any > difference in your example, vs what exists, other than that in your > example they are grouped together. > > Is that what you suggest I try, or are my aging eyes and brain missing > something there? > How about just using PAM? In dovecot.conf : auth_mechanisms = plain login passdb { driver = pam } userdb { driver = passwd } This will then call pam whose config is mainly determined by cat /etc/pam.d/dovecot #%PAM-1.0 #auth required pam_faillock.so preauth silent audit #auth [default=die] pam_faillock.so authfail audit @include common-auth @include common-account @include common-session Assuming the pam config is defaults then you will get pam authenticating local users against the local (unix) passwd file. In turn this will authenticate dovecot users and then postfix users This may sound complex but it's pretty standard to have postfix --> dovecot --> pam --> unix_local

2 2