- dovecot - dovecot.org

Re: [Dovecot] LDAP encryption
by James Devine 09 Oct '12

09 Oct '12

I don't think I understand. Right now the problem is the password retrieved from LDAP cannot be hashed to compare against what the user sent because it is encrypted. I have to perform my AES decryption before it can be hashed and compared. On Tue, Oct 9, 2012 at 1:03 PM, btb <btb(a)bitrate.net> wrote: > On 2012.10.09 14.41, James Devine wrote: > >> We have an LDAP server that contains AES encrypted passwords. So far I've >> been able to use this by adding a passdb module that encrypts the user's >> password prior to ldap comparison. Now I am looking at supporting >> client-side encrypted passwords. To do this I need to decrypt the >> password >> returned by LDAP. Is there a way to insert a module to do this decryption >> between ldap returning and the auth mechanism? >> >> that would be unwise, generally speaking. as a rule of thumb, in terms > of security fundamentals, only the rootdn [or equiv] should be able to read > the values in an ldap entry's password attribute. certainly the service > account used by dovecot should not. > > in the context of ldap, authentication should be accomplished by binding > as the user, not by retrieving attribute values and performing string > comparisons. among other things, this decouples the two components and > allows applications [e.g. dovecot] to be unconcerned with whatever password > hashing scheme the directory server might be using. > > -ben >

2 2

[Dovecot] LDAP encryption
by James Devine 09 Oct '12

09 Oct '12

We have an LDAP server that contains AES encrypted passwords. So far I've been able to use this by adding a passdb module that encrypts the user's password prior to ldap comparison. Now I am looking at supporting client-side encrypted passwords. To do this I need to decrypt the password returned by LDAP. Is there a way to insert a module to do this decryption between ldap returning and the auth mechanism?

1 0

[Dovecot] Quota - usage counting.
by wamp＠promax.media.pl 09 Oct '12

09 Oct '12

Hello, I use dovecot 1.2 version with postfix virtual users and mysql. All information about quota for every user is in mysql table. How dovecot compare if quota in database is over quota in /var/vmail/exampleuser directory ? It uses something like du command ? regards, Wamp

2 2

[Dovecot] some questions on dovecot or rather a mail system setup
by Christoph Anton Mitterer 09 Oct '12

09 Oct '12

Hi folks. Perhaps you find some time to look into this,... if you think I should better direct this do some dovecot mailing list,.. just tell :) I'm trying to plan my mail system and would have some questions. The overall idea is about the following: - There is a (internet) server, which is the MTA (which will be postfix) and imap and/or pop3 server (which shall be, guess, dovecot!). - Any spam filtering, virus-scanning, mail filtering happens on that server. - I have not yet decided on whether to use maildrop for this or Sieve. Maildrop is nice, but has one major deficiency which I don't know how to work around. - A few clients (that means I won't serve 100 of users) connect to that server via imap and should see all mails, etc. already in some fancy sorted hierarchy (that means filtered into different directories). So far nothing complicated. But now... - Apart from spam, I never delete mail; and because I'm subscribed to many lists, I get a lot of mail. - Storage on my server is limited and it's located somewhere at my ISP, so I generally do not trust it with respect to safety... For both reasons, I want the canonical archive of all mail to be at home at some local server. - The local server should also be an imap server, so that I can access the archive from may computers at home. - The local server won't be available from the internet. - The local archive should have the same folder hierarchy as the internet server (I'd prefer not to filter twice). Mail Flow: - I generally want to have _all_ mail (which is not sorted out because of being spam) to be archived at the local server. - But(!) I want to selectively keep (in addition) mail at the internet server. For example I may want to select the folder that contains all mail form some friend to be kept online completely. But I may want to decide that mailinglists keep only the last 10 days and/or 1000 messages of mail. - The idea is, that the local server regularly (when it is online/running) catches new mail from the internet server... and stores it in the archive. - So apart from new mail that has not yet been read, that local archive contains always all mails that are also on the internet server... the later may contain (for specific directories) the same, or just parts of. - The MUAs will then have two imap accounts, one to the internet server and one to the local archive,... each one being usable, depending on where I am. 1) This is where my first problem arises: How can I implement that mail flow, especially: - How do I secure that all mail is read from the internet server (i.e. that nothing is "forgotten"? - How do I make sure that no mails are retrieved twice (or more)? A problem which I often had with pop, when the mail client crashed during sync? - Further it must be secured, that when I delete something on the internet server, it is NOT deleted on the local server (on the next mail-fetching).... this is why I don't use the word "sync". a) One stupid solution would be, that I duplicate all mail on the online server,... one part is for staying online, one part is for being fetched to the local archive. As soon as it was fetched... that copy gets removed (always). That solution would give a clean and secured separation of both? b) I don't think offlineimap or any other caching-like solution is the right thing... especially as one must always fear that such a cache may be accidentally wiped. Are there better solutions than (a)? 2) Problem would be already a refinement of a working solution for (1) (but obviously not when using (1).(a) ). When e.g. reply to or forward a mail using the online server,... and that mail had already been fetched,... can I make the flag synced? 3) Is dovecot suitable for the local server? - Ideally of course, I would use dovecot there, too... because that would mean one piece of software less to understand. - I couldn't sue maildir locally, because I loose just to much space to the block fragmentation. - I'd prefer not to use dbox (the thing that the indices are crucial scares me a bit off). a) When using mbox... is dovecot able to manage a really big folder hierarchy that basically ever keeps growing... with easily several 100k mails per folder... and that is in total already over 100GB? - I would prefer to have fast full text search. Does dovecot provide this? I was looking into database backed mail systems (again,... just for the local archive)... namely dbmail and archiveopteryx (are there other open source solutions?)... Not sure which of the two... or whether it's a good idea at all. I remember some dovecot wiki page that showed a comparison which said that both do not perfectly implement imap. Any suggestions with respect to that? Or is there even some SQL backend planned for dovecot? Thanks a lot, Chris.

3 3

[Dovecot] Master User Question
by Marc Perkel 08 Oct '12

08 Oct '12

OK - I'm trying to do weird stuff so rather not answer why I'm doing this. Trying to log in using a master user: user@example.com*master@master.com When debugging the master authenticates - but then it tries to authenticate user(a)example.com and it's not found. And - it is true that the user doesn't actually exist. What I want to do is allow it to log in without checking if the user exists, just on the credentials of the master. I'm not quite understanding what the login attempt for user(a)example.com is trying to do. Is it looking for more necessary information? Hope I asked this clearly enough. Thanks in advance.

2 5

[Dovecot] Namespace Prefix Tutorial?
by Marc Perkel 08 Oct '12

08 Oct '12

I'm trying to grasp the namespace and prefix stuff and looking for a good tutorial page that explains what it is and how to use it. Thanks in advance

3 6

[Dovecot] another mysql quota problem
by Tibby 08 Oct '12

08 Oct '12

Hello! I am using dovecot 1.2.15 on Debian 6 I have Postfix configured with mysql, and also dovecot is auth-ing form mysql users table. The users table has username password quota stored. When I set qouta to whatever number, it doesnt even show in dovecot. telnet localhost 143 a login username(a)domain.tld password a getquotaroot inbox * QUOTAROOT "INBOX" a OK Getquotaroot completed. Basicly it doesn't show any kind of quota. in the /etc/dovecot/dovecot-sql.conf: driver = mysql connect = host=127.0.0.1 dbname=mail user=USERNAME password=PASSWORD default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; user_query = SELECT CONCAT(('/home/vmail/'), SUBSTRING_INDEX(email,'@',-1),'/',SUBSTRING_INDEX(email,'@',1),'/') AS home, 5000 AS uid, 5000 AS gid, CONCAT('maildir:storage=', floor(quota/1024)) AS quota FROM users WHERE email='%u'; Why it doesn't get the quota out from the mail DB's users table?

1 0

[Dovecot] Large subjects increase memory-usage and enlarge index-files
by Peer Heinlein 08 Oct '12

08 Oct '12

Several times we already had the problems, that accounts with more the 1.3 or 1.7 billion e-mails in one folder run out-of-memory, even if vsize_limit of 750 MB is set. In this case, the lmtpd-process haven't been able to allocate more memory to read/write/update the index-files and crashed (and the index-files become corrupted at the end.) [Please -- don't discuss about the need of INBOXes with 1.7 million (unread) e-mails (don't discuss that with ME. Personally, I agree, that there's NO need for that...).] But: We also noticed accounts with ~ 300.000 e-Mails running out of memory in the same situations. This happends, if the subject is very large (subject or some other header attributes). And: We've been able to reproduce out-of-memory-Problems with just 13.000 e-mails with VERY long subjects (e.g.: network monitoring status informations), even with a vsize_limit of 750 MB (which is already very much). 13.000 e-mails isn't very much. And it's easy to inject several thousands of prepared e-mails. Having many mails for accounts with huge (and broken) index-files slows down the delivery rate VERY much and increases the need for memory and cpu resources and I/O very much. So: This could be used for a very easy to do denial-of-service attac against Dovecot-based mailservers. I don't have a clear solution for that, Dovecot needs the subject information in its index files. But it looks like, it isn't a good idea to put the whole subject into the index. Maybe it's better/necessary to use just the first 50-70 characters for that and to keep the rest away from the index? I think I would prefer that even if that means, that accessing those folders with "special" e-mails will become slower because Dovecot has to get those informations directly from the e-mail. This performance issue is just a problem for the user. But crashing lmtpd-processes and lowering the delivery rate is a *real* problem for the whole IMAP-cluster. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

4 4

[Dovecot] [OT] How do I convert maildir to bsmtp format?
by Marc Perkel 08 Oct '12

08 Oct '12

Here's what I'm trying to do. I have a spam filtering operation as a front end for other servers. I've created a virtual server for spam storage where the user will be able to log in using squirrelmail/dovecot to review and release their spam. The email is stored in maildir format. Piecing it together I can use squirrelmail to pipe the email into something so that if a use finds a false positive they can hit the "release" button and the message is sent on to the recipient. Squirrelmail sends the message as you would receive it as stored in maildir format. I need to take this format and translate it to send it on to the user. Wondering what is the best way to do that. Something that translated it into bsmtp format would be great. I'm sure thare must be something out there. I just haven't found it yet. Thanks in advance.

3 2

[Dovecot] Dovecot configuration and question about IP trusted
by Mik J 07 Oct '12

07 Oct '12

Hello list, I've just finished to install Dovecot and things seems to work so far. After some little efforts though. My version is 2.0.20 Question 1: I'm trying to tighten the security a little bit and added in dovecot.conf login_trusted_networks = 192.168.1.0/30 Then restarted Dovecot My client has the IP 192.168.1.20 and it's still able to retrieve emails. I expected it to be forbidden. Am I missing something ? # dovecot -n | grep trust login_trusted_networks = 192.168.1.0/30 Question 2: I feel that Dovecot is slow. I'm doing my test with my iphone as an imap client. Test 1: I retrieve a mail on a remote server provided by a hosting company, it takes 2 seconds Test 2: I retrieve a mail on my server which is on my LAN, the mail includes a few letters in the subject and a few letters in the body. The action takes about 8 seconds. It's quite subtule to measure so first I would like to know if Dovecot tries to do a dns reverse lookup or something like that. And it would explain the overhead. Thank you

2 4