- dovecot - dovecot.org

[Dovecot] how secure is Dovecot when exposed to the Internet?
by Florin Andrei 10 Aug '09

10 Aug '09

$ dovecot -n # 1.1.11: /etc/dovecot/dovecot.conf # OS: Linux 2.6.28-11-server x86_64 Ubuntu 9.04 protocols: imap imaps managesieve I need to make an IMAP (actually imaps) server available over the Internet. Unfortunately, VPN is not available (not all clients support VPN), so I will have to expose the imaps port to the Internet. My question is: how reliable is Dovecot in such a setup? I am not talking about encryption (protecting the traffic between server and client). I am talking about having the daemon exposed to anything coming in from the Internet, buffer overflows and stuff like that. What's the security history of this software in situations like this? -- Florin Andrei http://florin.myip.org/

2 2

[Dovecot] http://wiki.dovecot.org/LDA typo
by LEVAI Daniel 09 Aug '09

09 Aug '09

-Note that dovecot.conf file must be world readable to enable deliver process read it, while running with user priviledges. +Note that dovecot.conf file must be world readable to enable deliver process read it, while running with user privileges. -- LÉVAI Dániel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

2 2

[Dovecot] Wiki entry for expire plugin, PostgreSQL trigger needs update
by Stefan Förster 09 Aug '09

09 Aug '09

The wiki entry at http://wiki.dovecot.org/Plugins/Expire needs an update for Dovecot 1.2 and PostgreSQL: -- v1.2+: CREATE OR REPLACE FUNCTION merge_expires() RETURNS TRIGGER AS $$ BEGIN IF exists(SELECT 1 FROM expires WHERE username = NEW.username AND mailbox = NEW.mailbox) THEN UPDATE expires SET expire_stamp = NEW.expire_stamp WHERE username = NEW.username AND mailbox = NEW.mailbox; RETURN NULL; ELSE RETURN NEW; END IF; END; $$ LANGUAGE plpgsql; CREATE TRIGGER mergeexpires BEFORE INSERT ON expires FOR EACH ROW EXECUTE PROCEDURE merge_expires(); At least that's what I think after looking at the code: iter = dict_iterate_init(dict, DICT_EXPIRE_PREFIX, DICT_ITERATE_FLAG_RECURSE | DICT_ITERATE_FLAG_SORT_BY_VALUE); /* We'll get the oldest values (timestamps) first */ while (dict_iterate(iter, &key, &value) > 0) { /* key = DICT_EXPIRE_PREFIX<user>/<mailbox> */ userp = key + strlen(DICT_EXPIRE_PREFIX); [...] T_BEGIN { username = t_strdup_until(userp, p); If this code does somehow iterate usernames which are not present in the dict, I apologize. Cheers Stefan

1 1

[Dovecot] User Auth
by Richard Harwood 09 Aug '09

09 Aug '09

Hello all, I am new to the mailing list and I'm in the process of setting up a LAMP + mail server. I have configured my MTA (Postfix) to deliver messages to: /var/spool/mail/vhosts/domain.tld/name I have configured Dovecot as follows: -- # 1.2.2: /usr/local/etc/dovecot.conf protocols: imap imaps pop3 ssl: no disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_privileged_group: mail mail_location: mbox:/var/spool/mail/vhosts/%d:INBOX=/var/spool/mail/vhosts/%d/%n mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 lda: postmaster_address: postmaster(a)example.com auth default: debug: yes passdb: driver: passwd-file args: /etc/passwd.dovecot userdb: driver: passwd -- Password excepted, my passwd.dovecot file containing a single virtual user looks like: richard:{plain}password:504:505::/home/vmail The uid/gid is the same as used by Postfix (a dedicated vmail user/group). That user/group owns the mbox I am trying to manipulate in this example. When I attempt to login via telnet on port 110 I get the error: +OK Dovecot ready. user richard(a)richardaharwood.com +OK pass password -ERR Authentication failed. It seems to dislike the fact I specify the domain as part of the login username. If I repeat and login as: user richard - I am authenticated, however I get the error: -ERR [IN-USE] Couldn't open INBOX: Internal error occurred. Refer to server log for more information. Tailing the maillog, I see the following: Aug 8 17:19:01 richardaharwood dovecot: auth(default): client in: AUTH 1 PLAIN service=pop3 secured lip=83.170.110.193 rip=83.170.110.193 lport=110 rport=58115 resp=<hidden> Aug 8 17:19:01 richardaharwood dovecot: auth(default): passwd-file(richard,83.170.110.193): lookup: user=richard file=/etc/passwd.dovecot Aug 8 17:19:01 richardaharwood dovecot: auth(default): client out: OK 1 user=richard Aug 8 17:19:01 richardaharwood dovecot: auth(default): master in: REQUEST 4 3603 1 Aug 8 17:19:01 richardaharwood dovecot: auth(default): passwd(richard,83.170.110.193): lookup Aug 8 17:19:01 richardaharwood dovecot: auth(default): master out: USER 4 richard system_groups_user=richard uid=500 gid=500 home=/home/richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Effective uid=500, gid=500, home=/home/richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): mbox: data=/var/spool/mail/vhosts/:INBOX=/var/spool/mail/vhosts//richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): fs: root=/var/spool/mail/vhosts, index=, control=, inbox=/var/spool/mail/vhosts//richard Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): open(/var/spool/mail/vhosts//richard) failed: Permission denied (euid=500(richard) egid=500(richard) missing +x perm: /var/spool/mail/vhosts/) Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2009-08-08 17:19:01] Aug 8 17:19:01 richardaharwood dovecot: POP3(richard): Couldn't open INBOX top=0/0, retr=0/0, del=0/0, size=0 Aug 8 17:19:01 richardaharwood dovecot: pop3-login: Login: user=<richard>, method=PLAIN, rip=83.170.110.193, lip=83.170.110.193, secured Assuming I could login with richard(a)richardaharwood.com, I should imagine Dovecot will successfully find the inbox, which is located at /var/spool/mail/vhosts/richardaharwood.com/richard in this example. I also notice the effective uid/gid is not that specified in the passwd file? The uid/gid appears to be that of my own ssh account which is not connected to the mail account that I wish to simply access as a virtual user. Would anyone be kind enough to point me in the right direction? In a nutshell, where am I going wrong with my authentication? This is a basic setup for the time being, until I get my head around it, but any pointers would be really appreciated. Have spent quite a few hours but I don't feel much closer to getting to the bottom of it! :) Many thanks, Richard

2 1

[Dovecot] multiple auth-client sockets
by LEVAI Daniel 09 Aug '09

09 Aug '09

Hi! I'm gonna need to use dovecot's auth-client socket in an authentication program. Now the auth-client socket is only used by my MTA, which is postfix. Because postfix's smtpd process (which uses the auth-client socket) runs chrooted under postfix's spool directory, I must create the auth-client socket under that spool directory. However, to reach that socket from another chrooted program is impossible. Can I create multiple instances of auth-client sockets? I tried to define another client {} stanza in socket listen {} in dovecot.conf, but only the last client socket got created. I need only a true or false response from dovecot regarding the authentication, and I thought that this is exactly what auth-client socket will do. However, if I can not reach it, is there any alternative to this? What's up with the auth-master or auth-worker sockets? Are they capable of respond to an auth request too? btw, I'm running dovecot-1.2.3 Thanks! Daniel -- LÉVAI Dániel PGP key ID = 0x4AC0A4B1 Key fingerprint = D037 03B9 C12D D338 4412 2D83 1373 917A 4AC0 A4B1

3 3

[Dovecot] autocreate plugin fails to subscribe mailbox in public namespace
by Stefan Förster 09 Aug '09

09 Aug '09

Hi, I'm one step away from replacing a 7 years old qmail/uw-imapd setup with some state of the art soft- and hardware. We got migration scripts and test almost done - just one thing that keeps failing: The autocreate plugin is supposed to subscribe new users to different mailboxes, one of them being in namespace "Public." - this subscription to "Public.announcements" fails. Below is a dovecot -n - and no, there are no error messages in the logs. # 1.2.2: /etc/dovecot/dovecot.conf # OS: Linux 2.6.30-bpo.1-amd64 x86_64 Debian 5.0.2 log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps managesieve listen(default): *:143 listen(imap): *:143 listen(managesieve): * ssl_listen(default): *:993 ssl_listen(imap): *:993 ssl_listen(managesieve): ssl_cert_file: /etc/ssl/owncerts/snakeoil.crt ssl_key_file: /etc/ssl/private/snakeoil.key login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(managesieve): /usr/lib/dovecot/managesieve-login verbose_proctitle: yes mail_privileged_group: vmail mail_location: maildir:~/Maildir mbox_write_locks: fcntl dotlock mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(managesieve): /usr/lib/dovecot/managesieve mail_process_size: 384 mail_plugins(default): quota imap_quota fts fts_squat acl autocreate expire trash mail_plugins(imap): quota imap_quota fts fts_squat acl autocreate expire trash mail_plugins(managesieve): mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(managesieve): /usr/lib/dovecot/modules/managesieve namespace: type: private separator: . inbox: yes list: yes subscriptions: yes namespace: type: public separator: . prefix: Public. location: maildir:/export/vmailboxes/public:INDEX=~/Maildir/public list: yes lda: postmaster_address: postmaster(a)test.cite.lan hostname: testvm06.test.cite.lan mail_plugins: quota sieve expire trash auth_socket_path: /var/run/dovecot/auth-master auth default: mechanisms: plain login cram-md5 passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: sasl master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: vmail plugin: quota: maildir:User quota quota_warning: storage=90%% /usr/local/bin/quota-warning.sh 90 quota_warning2: storage=95%% /usr/local/bin/quota-warning.sh 95 sieve: ~/.dovecot.sieve sieve_storage: ~/sieve sieve_extensions: +imapflags fts: squat fts_squat: partial=4 full=10 acl: vfile autocreate: Trash autocreate2: Drafts autocreate3: Sent autocreate4: learn-spam autosubscribe: Trash autosubscribe2: Drafts autosubscribe3: Sent autosubscribe4: learn-spam autosubscribe5: Public.announcements autosubscribe6: INBOX expire: Trash 60 Trash/* 60 expire_dict: proxy::expire trash: /etc/dovecot/dovecot-trash.conf dict: expire: pgsql:/etc/dovecot/dovecot-dict-expire.conf Any hints are really appreciated. Cheers Stefan BTW: If anybody is interested, I could provide load and usage statistics of our old and new software once step 1 of our migration (new hardware is step 2) is done. Only ~1000 users, but still...

2 1

[Dovecot] fatal: no SASL authentication mechanisms
by Ebbe Hjorth 09 Aug '09

09 Aug '09

Hi, I have setup freebsd, postfix, dovecot and maia, but all the time i get the following error in /var/log/maillog - and i cant google me to the solution, please advice. Aug 9 12:18:49 mail02 dovecot: auth(default): Authentication client trying to connect to master socket Aug 9 12:18:49 mail02 postfix/smtpd[1356]: fatal: no SASL authentication mechanisms Aug 9 12:18:50 mail02 postfix/master[777]: warning: process /usr/local/libexec/postfix/smtpd pid 1355 exit status 1 Aug 9 12:18:50 mail02 postfix/master[777]: warning: /usr/local/libexec/postfix/smtpd: bad command startup -- throttling Aug 9 12:18:50 mail02 amavis[834]: (00834-04) mail_via_smtp: 450 4.4.1 Can't connect to 127.0.0.1 port 10025, Bad file descriptor at /usr/local/sbin/amavisd-maia line 6599, <GEN12> line 229., id=00834-04 mail02# dovecot -n # 1.1.16: /usr/local/etc/dovecot.conf # OS: FreeBSD 7.2-RELEASE-p2 i386 ufs protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/dovecot/cert.pem ssl_key_file: /etc/ssl/dovecot/key.pem disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_greeting: Apz.dk mail server ready. login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no verbose_proctitle: yes first_valid_uid: 125 last_valid_uid: 125 first_valid_gid: 125 last_valid_gid: 125 mail_privileged_group: mail mail_location: maildir:/usr/local/virtual/%d/%n mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: mechanisms: plain login username_format: %Lu passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen client: path: /var/run/dovecot/auth-client mode: 432 master: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix

2 2

[Dovecot] Creating a "default" domain
by Charles Sprickman 09 Aug '09

09 Aug '09

Hello, I'm setting up a test server to work through the issues involved in bringing a bunch of vpopmail/qmail/courier users into a postfix/dovecot server. So far I'm seeing lots of info to aid in the transition. One thing I'm lost on is that since Dovecot is providing all the auth mechanisms rather than vpopmail, I'm not sure how to emulate a particular vpopmail behavior we rely on. Vpopmail allows for the concept of a "default" domain for authentication. So if I have a bunch of domains, and one is "example.com", users in that domain can login with only the username part of their id (ie: "john") rather than supplying the domain (ie: "john(a)example.com"). I need to continue to offer this unless I want to walk a few hundred users through reconfiguring their mail clients. :) Any pointers? Thanks, Charles ___ Charles Sprickman NetEng/SysAdmin Bway.net - New York's Best Internet - www.bway.net spork(a)bway.net - 212.655.9344

2 2

[Dovecot] convert config from 1.1.2_1 to 1.1.16
by Ebbe Hjorth 09 Aug '09

09 Aug '09

Hi, Im tryin to follow a guide, telling me howto setup freebsd with postfix and dovecot. The text in bold (first section), is what the guide says, and the text that follows is what the /usr/local/etc/dovecot.conf files says. Can you please help me on how to convert from the 1.1.2_1 setup to the correct configuration for the 1.1.16? / Thank you very much. *socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } * socket listen { master { # Master socket provides access to userdb information. It's typically # used to give Dovecot's local delivery agent access to userdb so it # can find mailbox locations. path = /var/spool/postfix/private/auth mode = 0600 # Default user/group is the one who started dovecot-auth (root) #user = #group = } client { # The client socket is generally safe to export to everyone. Typical use # is to export it to your SMTP server so it can do SMTP AUTH lookups # using it. path = /var/run/dovecot/auth-client mode = 0660 }

3 5

[Dovecot] v1.2.3 released
by Timo Sirainen 08 Aug '09

08 Aug '09

http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz http://dovecot.org/releases/1.2/dovecot-1.2.3.tar.gz.sig A few days later than I wanted, but here it is. * Mailbox names with control characters can't be created anymore. Existing mailboxes can still be accessed though. + Allow namespace prefix to be opened as mailbox, if a mailbox already exists in the root dir. - Maildir: dovecot-uidlist was being recreated every time a mailbox was accessed, even if nothing changed. - listescape plugin was somewhat broken - Compiling fixes for non-Linux/BSDs - imap: tb-extra-mailbox-sep workaround was broken. - ldap: Fixed hang when >128 requests were sent at once. - fts_squat: Fixed crashing when searching virtual mailbox. - imap: Fixed THREAD .. INTHREAD crashing.

2 1