- dovecot - dovecot.org

Re: [Dovecot] Logging in to a virtual users Maildir
by Joseph Tam 02 Nov '13

02 Nov '13

Steve Downes <steve(a)kingswayelec.co.uk> writes: > When I open a local mutt I get the following:- > 1) could not connect to vmail-s (connection refused) (vmail-s is the > mailserver host) Full stop, anything past here and you're debugging noise. You've configured out SSL/TLS on dovecot ... > /etc/dovecot/dovecot.conf > # disable ssl for now > ssl = no ... but your Mutt configuration has ... > ~/.mutt.muttrc > set spoolfile=imaps://steve@vmail-s/ ... and your debug logs state ... > [2013-10-31 14:35:23] Reading imaps://steve@vmail-s/... > [2013-10-31 14:35:23] Looking up vmail-s... > [2013-10-31 14:35:23] Connecting to vmail-s... > [2013-10-31 14:35:23] Connection failed. errno: 111... > [2013-10-31 14:35:23] Could not connect to vmail-s (Connection > refused). > [2013-10-31 14:35:25] Connected to vmail-s:993 on fd=-1 You configured dovecot to accept only plain IMAP (on port 143), but your mail reader is configured to connect to an IMAP/SSL service (port 993). Maybe it will start working if you configure Mutt set spoolfile=imap://steve@vmail-s/ (Just guessing -- I don't use Mutt.) Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] Shared namespace, separator, username and dots.
by Marcio Merlone 02 Nov '13

02 Nov '13

Hi folks, I run a legacy mailserver that i had replaced courier-imap for dovecot 1.2. Everything is fine except for shared namespace. Maildir structure has been created using dot '.' as folder separator. It happens that all our users are created as name.surname as default. So when I want to select a shared folder, MUA end up with the following IMAP command: select shared.jhon.doe.folder.subfolder Obviously I took ages to figure why it won't work since it takes 'doe' as a folder and not a username part. When sharing a folder from 'sales' user, for example, it works fine. What do you suggest to make shared folders work for all without rebuilding hundreds of maildirs to change folder separator from '.' to '/'? Thanks for any hint. # 1.2.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-52-server x86_64 Ubuntu 10.04.4 LTS log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps managesieve ssl_listen: * disable_plaintext_auth: no verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login login_process_per_connection: no login_max_processes_count: 1024 max_mail_processes: 1024 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(managesieve): 10 first_valid_gid: 0 mail_privileged_group: mail mail_location: maildir:~/Maildir:INDEX=/var/cache/dovecot/%n fsync_disable: yes maildir_very_dirty_syncs: yes mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_plugins(default): quota imap_quota acl imap_acl mail_plugins(imap): quota imap_quota acl imap_acl mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve namespace: type: private separator: . inbox: yes list: yes subscriptions: yes namespace: type: shared separator: . prefix: shared.%%u. location: maildir:%%h/Maildir:INDEX=%u/Maildir/shared/%%u list: children subscriptions: yes lda: postmaster_address: postmaster(a)a1.ind.br mail_plugins: quota sieve acl quota_full_tempfail: yes auth_socket_path: /var/run/dovecot/auth-master fsync_disable: no auth default: mechanisms: plain login master_user_separator: * passdb: driver: pam args: session=yes blocking=yes dovecot passdb: driver: passwd-file args: /etc/dovecot/passwd.masterusers pass: yes master: yes userdb: driver: nss args: service=ldap blocking=yes socket: type: listen client: path: /var/spool/postfix/private/dovecot mode: 436 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 438 plugin: sieve: ~/.dovecot.sieve acl: vfile acl_shared_dict: proxy::acl dict: acl: mysql:/etc/dovecot/acl-dict-sql.conf -- *Marcio Merlone* TI - Administrador de redes *A1 Engenharia - Unidade Corporativa* Fone: +55 41 3616-3797 Cel: +55 41 9689-0036 http://www.a1.ind.br/ <http://www.a1.ind.br>

3 2

[Dovecot] doveadm can't import his own mdboxes
by Peer Heinlein 02 Nov '13

02 Nov '13

We're running Dovecot 2.1.17 on Debian: # 2.1.17 (9efbc0731929): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab078.27.debug i686 Debian 7.1 simfs and we're having this namespace configuration: mail_location = mdbox:/var/mail/%Ld/%Ln/mdbox namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = prefix = separator = . subscriptions = yes type = private } As you can see, our namespace seperator is "." and not "/": a LIST "" "*" * LIST (\HasChildren) "." INBOX.test * LIST (\HasNoChildren) "." INBOX.test.huhu * LIST (\HasNoChildren \Trash) "." Trash * LIST (\HasChildren) "." INBOX a OK List completed. The problem is, that doveadm isn't able to import his own mdbox-directory: 1) delete the whole mdbox folder # rm -rf mdbox 2) create the new mdbox folder and create some subfolders in it # doveadm mailbox create -u max.muster INBOX.test # doveadm mailbox create -u max.muster INBOX.test.huhu 3) put a mail into a subfolder 4) try to re-import the whole mdbox: it doesn't work # doveadm import -u max.muster mdbox:mdbox BACKUP all doveadm(max.muster): Error: Couldn't create mailbox BACKUP.INBOX/test/huhu: Character not allowed in mailbox name: '/' Looks like there's something wrong in the namespace or like doveadm is working with a hardcoded internal namespace... Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 2

[Dovecot] Configuring SPECIAL-USE Dovecot 2.0.9
by Keith Mountifield 01 Nov '13

01 Nov '13

Hi All, I'm trying to configure Dovecot 2.0.9 to support Outlook 2013. As I understand it, I need to configure XLIST. I have added imap_capability = +XLIST to 20-imap.conf When I try to query the IMAP folders I get an error "An IMAP command Failed". Looking at the logs I get XLIST Command not found. I can only assume that I'm missing something in the configuration. Any help would be greatly appreciated Thanks Keith

2 1

[Dovecot] init script as provided http://wiki2.dovecot.org/DovecotInit
by Jess Portnoy 01 Nov '13

01 Nov '13

Hello list, I would add: # dovecot Startup script for the dovecot server # # chkconfig: - # processname: dovecot # config: /path/to/config # pidfile: /path/to/pid So that it supports the chkconfig used by RHEL and clones too. Also, maybe it should be installed by the Makefile's install target? it could then also set: DAEMON=/path/to/dovecot/daemon instead of: DAEMON=/usr/local/sbin/dovecot Cause naturally, it will know the prefix chosen. May the source be with you, Jess Portnoy

2 1

[Dovecot] Logging in to a virtual users Maildir
by Steve Downes 01 Nov '13

01 Nov '13

Trying to set up a mailserver to run exim4, dovecot2, (clamav procmail or similar not yet installed) on a virtual machine & access it from various hosts mostly using Mutt. So far no attempt at encryption although there are some pem files from a previous attempt & some evidence from the mutt debug file they may be being used . So far I have attempted to set up dovecot to by accessed by MUAs only & tried to access it from Mutt on on the mailserver virtual machine & on another on locally networked machine (no networking problems). When I open a local mutt I get the following:- 1) could not connect to vmail-s (connection refused) (vmail-s is the mailserver host) 2) mutt then opens, with a blank message screen 3) from mutt I then put C (open mailbox ? for list) & ?. 4) I then get a file list for the mailbox including all dovecot files but no mailbox files except cur. new, & tmp 5) if enter on ../ I get (presumably) /home/vmail/users/steve/ showing Maildir as the 2nd line 6) select Maildir gives me my inbox but continuing the process does not give me acces to any other folders. The files in my mailbox are from my previous version of Dovecot (V1*) but I have previously tried to start anew set of mailboxes with similar results. I enclose below:- my Dovecot.conf file My muttrc file a .muttdebug0 file Dovecot log files show nothing but Dovecot stop/start lines. Any pointers please? Steve --------------------------------- /etc/dovecot/dovecot.conf # based on Dovecot.org/HowTo/SimpleVirtualInstall # Dovecot version 2 # ASD 131028 protocols = imap # separate dovecot logging log_path = /var/log/dovecot.log # info_log_path = /var/log/dovecot-info.log info_log_path = /var/log/dovecot.log mail_debug=yes # disable ssl for now ssl = no disable_plaintext_auth = no # Maildir boxes mail_location = maildir:~/home/vmail/%u/Maildir # if your using pop3, you'll need this # pop3_uidl_format = %g # authentication configuration auth_verbose=yes auth_debug=yes auth_mechanisms=plain auth_debug_passwords=yes passdb { driver = passwd-file args = /etc/dovecot/passwd } userdb { driver = static args = uid=vmail gid=vmail home=/home/vmail/%u/Maildir } -------------------------------------------- ~/.mutt.muttrc # muttrc file started 131029 set mbox_type="Maildir" set spoolfile=imaps://steve@vmail-s/ set folder="/home/vmail/users/steve" unset mark_old set postponed="/home/vmail/users/steve/drafts/" set postpone=ask-yes set imap_check_subscribed set abort_nosubject=yes set include=yes set editor="emacsclient %s" set alias_file="/home/steve/.mutt/mutt-aliases --------------------------------------------- .muttdebug0 [2013-10-31 14:35:23] Mutt/1.5.21 (2010-09-15) debugging at level 2 [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc'. [2013-10-31 14:35:23] Reading configuration file '/usr/lib/mutt/source-muttrc.d|'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/charset.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/colors.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/compressed-folders.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/gpg.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/smime.rc'. [2013-10-31 14:35:23] Reading configuration file '/home/steve/.mutt/muttrc'. [2013-10-31 14:35:23] Reading imaps://steve@vmail-s/... [2013-10-31 14:35:23] Looking up vmail-s... [2013-10-31 14:35:23] Connecting to vmail-s... [2013-10-31 14:35:23] Connection failed. errno: 111... [2013-10-31 14:35:23] Could not connect to vmail-s (Connection refused). [2013-10-31 14:35:25] Connected to vmail-s:993 on fd=-1 [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... [2013-10-31 14:35:55] Scanning /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] Scanning /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] ../mh.c:728: queueing 1382383788.2292_0.mail-s:2,Sa [2013-10-31 14:35:55] ../mh.c:728: queueing 1381593772.6226_1.mail-s:2,S [2013-10-31 14:35:55] ../mh.c:728: queueing 1382022143.2719_1.mail-s:2,S [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0/54 (0%) [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0/54 (0%) [2013-10-31 14:35:55] parse_parameters: `boundary="==Multipart_Boundary_xc75j85x"' [2013-10-31 14:35:55] parse_parameter: `boundary' = `==Multipart_Boundary_xc75j85x' [2013-10-31 14:35:55] parse_parameters: `charset="us-ascii"' [2013-10-31 14:35:55] ../mh.c:773 maildir_add_to_context(): Considering [2013-10-31 14:35:55] ../mh.c:782 Adding header structure. Flags: OR [2013-10-31 14:35:55] ../mh.c:773 maildir_add_to_context(): Considering [2013-10-31 14:35:55] Sorting mailbox... (I have cut most of the repeated lines for each email out of this file)

2 1

[Dovecot] double login lines
by Andreas Meyer 31 Oct '13

31 Oct '13

Hi! Who can tell me why I have double login lines for some accounts? Oct 31 12:35:36 imap-login: Info: Login: user=<anmeyer(a)anup.de>, method=CRAM-MD5, rip=84.179.59.177, lip=78.47.3.18, mpid=29905, TLS, TLSv1 with cipher RC4-MD5 (128/128 bits) Oct 31 12:35:36 imap-login: Info: Login: user=<anmeyer(a)anup.de>, method=CRAM-MD5, rip=84.179.59.177, lip=78.47.3.18, mpid=29906, TLS, TLSv1 with cipher RC4-MD5 (128/128 bits) I can not think of any reason why this happens at the same time. Greetings Andreas

2 1

[Dovecot] dovecot-ldap : can't find user in OU subtree
by me＠electronico.nc 31 Oct '13

31 Oct '13

Hi all, Well, I've compiled and installed dovecot 2.2.6 with following options: > ./configure --prefix=/usr/ --sysconfdir=/etc/ --with-mysql > --libexecdir=/usr/lib/ --localstatedir=/var > --with-moduledir=/usr/lib/dovecot/modules --disable-rpath > --disable-static --with-zlib --with-bzlib --with-solr --with-ldap > --with-gssapi --with-nss doveconf -n: > # 2.2.6: /etc/dovecot/dovecot.conf > # OS: Linux 3.8.0-32-generic x86_64 Ubuntu 12.04.3 LTS ext4 > auth_debug = yes > auth_mechanisms = plain login > auth_verbose = yes > first_valid_gid = 20001 > first_valid_uid = 20001 > log_timestamp = %Y-%m-%d %H:%M:%S > mail_debug = yes > mail_gid = 20001 > mail_home = /media/data/email/%n > mail_location = maildir:/media/data/email/%n/mail > mail_plugins = fts fts_solr acl zlib mail_log notify > mail_uid = 20001 > managesieve_notify_capability = mailto > managesieve_sieve_capability = comparator-i;octet > comparator-i;ascii-casemap fileinto reject envelope encoded-character > vacation subaddress comparator-i;ascii-numeric relational regex > imap4flags copy include variables body enotify environment mailbox > date spamtest spamtestplus virustest > namespace { > list = no > location = > maildir:/media/data/email/%%n/mail:INDEX=/media/data/email/%n/mail/shared/%%n > prefix = shared/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = maildir:/media/data/email/%n/mail > mailbox Sent { > auto = subscribe > } > mailbox Spam { > auto = subscribe > } > mailbox SpamFalse { > auto = subscribe > } > mailbox SpamToLearn { > auto = subscribe > } > prefix = > separator = / > type = private > } > passdb { > args = /etc/dovecot/dovecot-ldap-passdb.conf.ext > driver = ldap > } > plugin { > acl = vfile > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename save mailbox_create > mail_log_fields = uid box msgid size > sieve = /media/data/email/%n/dovecot.sieve > sieve_after = /media/data/email/sieve/global.sieve > sieve_dir = /media/data/email/%n/sieve > zlib_save = bz2 > zlib_save_level = 9 > } > protocols = imap pop3 sieve lmtp > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0660 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0640 > user = vmail > } > } > service imap-login { > inet_listener imap { > address = * > port = 143 > } > inet_listener imaps { > address = * > port = 993 > ssl = yes > } > process_limit = 256 > } > service lmtp { > inet_listener lmtp { > address = * > port = 24 > } > user = vmail > } > service managesieve-login { > inet_listener sieve { > address = * > port = 4190 > } > process_limit = 256 > vsz_limit = 64 M > } > service pop3-login { > inet_listener pop3 { > address = * > port = 110 > } > inet_listener pop3s { > address = * > port = 995 > ssl = yes > } > } > ssl = required > ssl_ca = </etc/postfix/tls/cacert.pem > ssl_cert = </etc/postfix/tls/radiodjiido-cert.pem > ssl_key = </etc/postfix/tls/radiodjiido-key.pem > ssl_verify_client_cert = yes > userdb { > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > driver = ldap > } > protocol imap { > imap_client_workarounds = delay-newmail > imap_max_line_length = 64 k > mail_max_userip_connections = 20 > mail_plugins = acl imap_acl mail_log notify zlib > } > protocol pop3 { > mail_plugins = zlib mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } > protocol sieve { > managesieve_logout_format = bytes ( in=%i : out=%o ) > } > protocol lda { > info_log_path = > log_path = > mail_plugins = sieve zlib mail_log notify > quota_full_tempfail = yes > syslog_facility = mail > } > protocol lmtp { > info_log_path = > log_path = > mail_plugins = sieve fts zlib mail_log notify > quota_full_tempfail = yes > } /etc/dovecot/dovecot-ldap-passdb.conf.ext: > hosts = localhost > auth_bind = yes > auth_bind_userdn = cn=%u,OU=users,dc=domain,dc=lan > ldap_version = 3 > base = ou=users,dc=domain,dc=lan > scope = subtree > pass_filter = (&(objectClass=person)(cn=%u)(mail=*)) /etc/dovecot/dovecot-ldap-userdb.conf.ext: > hosts = localhost > dn = cn=ldap,cn=Users,DC=domain,DC=lan > dnpass = My_secret_pass > ldap_version = 3 > base = OU=users,DC=domain,DC=lan > scope = subtree > user_attrs = uid=20001, gid=20001, home=/media/data/email/%n, > mail=/media/data/email/%n/mail > user_filter = (&(objectClass=person)(cn=%n)(mail=*)) > iterate_attrs = cn=user > iterate_filter = (objectClass=person) All seems to work as expected up-to-now, but : If I move a user from OU 'users' to a sub-OU 'administrative' on Active Directory : -> The user can't login anymore to Dovecot I have added the "scope = subtree" to the userdb and passdb files but it doesn't change anything. Here is the debug part when user test3 (located in ou=users, ou=administrative) tries to login: > Oct 30 18:49:12 serveur dovecot: auth: Debug: auth client connected > (pid=4292) > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=L6uskfDpKwAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54827 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:49:12 serveur dovecot: auth: > ldap(test3,10.10.20.208,<L6uskfDpKwAKChTQ>): invalid credentials > Oct 30 18:49:14 serveur dovecot: auth: Debug: client passdb out: > FAIL#0111#011user=test3 As soon as I move user 'test3' back to ou=users, it can login ... > Oct 30 18:53:57 serveur dovecot: auth: Debug: Loading modules from > directory: /usr/lib/dovecot/modules/auth > Oct 30 18:53:57 serveur dovecot: auth: Debug: Read auth token secret > from /var/run/dovecot/auth-token-secret.dat > Oct 30 18:53:57 serveur dovecot: auth: Debug: auth client connected > (pid=4303) > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=h+ypovDpUAAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54864 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > OK#0111#011user=test3 Thanks in advance for your time and lights. Nicolas

3 5

[Dovecot] IMAP Dovecot unknown namespace creating root folders
by marcus lively 31 Oct '13

31 Oct '13

Hi, I hope someone can point me in the right direction here. I am migrating a mailbox from a non cPanel server, and the mailboxes have folders which seem to be at the same level as the Inbox. The users access these mailboxes using IMAP. The new server configuration is Exim > Dovecot 1.2.17 > Maildir with the standard cPanel install settings. dovecot -n output below I have created the new mailbox within cPanel however when I try to create a 'top level' folder in Outlook I receive the error 'Cannot create the folder: Unknown namespace' (Note I also tried this with the windows mail client to ensure it was not client side) I know that I can get round this by setting the root folder path on the client to 'Inbox' and therefore the folders would be created as sub-folders of Inbox, and this would not be visible to the user, but I was hoping to migrate without touching the clients. Should dovecot report the default root folder path automatically, or create a default top level namespace for each user so this can be done, or could I have just gone wrong and missed something. Any advice on getting this working appreciated, thanks for any help Maspry # 1.2.17: /etc/dovecot.conf # OS: Linux 2.6.32-71.el6.x86_64 x86_64 CentOS release 6.4 (Final) protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/dovecot/ssl/dovecot.crt ssl_key_file: /etc/dovecot/ssl/dovecot.key ssl_cipher_list: ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_process_per_connection: no login_processes_count: 2 login_max_processes_count: 50 login_max_connections: 500 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 3 maildir_copy_preserve_filename: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): acl quota imap_quota mail_plugins(imap): acl quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): UID%u-%v pop3_logout_format(default): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(imap): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(pop3): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster(a)example.com auth default: mechanisms: plain login cache_size: 1024 username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+% passdb: driver: checkpassword args: /usr/local/cpanel/bin/dovecot-auth userdb: driver: prefetch socket: type: listen client: path: /var/run/dovecot/auth-client mode: 438 plugin: quota: maildir quota_rule: Trash:ignore acl: vfile

2 2

Re: [Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 30 Oct '13

30 Oct '13

Currently our dovecot servers are on our webhosting linux boxes. We are using the LAMP stack to host websites, and also doing email with postfix & dovecot on these systems. We provide this as a hosting setup for 100+ accounts/websites on a single server (a multi-tenant setup). Each customer has anywhere between 1-100 email accounts which Dovecot services. If a customer has vulnerable PHP code on a website, some of these will allow a remote file upload. I have seen cases where they upload a PHP script that is a sort of web-based console/shell to the server (file-system, etc.). It provides several tools which all run through the uploaded PHP script to try to brute force and do other attacks. I've seen attempts at a root exploit. We've never had a root exploit and any such case of a customer's site being hacked has been easily contained by simple filesystem permissions being correct (and the fact that we have apache setup to run all scripts as the user who is the owner of the script files, which confines the script to that users' permissions). Still nobody loves the idea of bad guys trying to hack on your box. So.... given that type of scenario, if filesystem permissions weren't correct, or some new exploit surfaced that allowed someone bypass or elevate to root, then they could theoretically have access to the entire fileystem including where emails are stored. I hope to never have this sort of thing happen. We patch our systems regularly and have other security measures we follow to prevent this. We also are managing most of the PHP scripts customers use ourselves now and are updating those for the CMS' and other systems proactively. However, it would be nice to know that even if we were breached, the emails on the server were encrypted and would be completely useless to an attacker. This type of encryption is ideal and some regulations prefer (although don't require) it. - Doug Mortensen Network Consultant Impala Networks P: 505.327.7300 -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Michael Orlitzky Sent: Monday, October 28, 2013 11:52 AM To: dovecot Subject: Re: [Dovecot] Encryption solution for messages at rest On 10/28/2013 12:02 PM, Douglas Mortensen wrote: > Hi, > > We have clients with various security & compliance requirements. > Although not required, it would be ideal to have messages encrypted at > rest. You can rule out a lot of the crazier options by answering the questions, (a) What attack scenario do you have in mind? (b) How will encryption help?

11 15