- dovecot - dovecot.org

[Dovecot] Dovecot under brute force attack - nice attacker
by henry ritzlmayr 05 Jun '09

05 Jun '09

Hi List, optimizing the configuration on one of our servers (which was hit by a brute force attack on dovecot) showed an odd behavior. Dovecot Version 1.0.7 (CentOS 5.2) The short story: On one of our servers an attacker did a brute force attack on dovecot (pop3). Since the attacker closed and reopened the connection after every user/password combination the logs showed many lines like this: dovecot: pop3-login: Aborted login: user=<test>,...... The problem: If the attacker wouldn't have closed and reopened the connection no log would have been generated and he/she would have endless tries. Not even an iptables/hashlimit or fail2ban would have kicked in. How to reproduce: telnet dovecot-server pop3 user test pass test1 user test pass test2 ... QUIT ->Only the last try gets logged. If I enable auth_verbose every attempt gets logged, but if I read the docs correctly this option should only be used for figuring out why authentication isn't working. Question: Is there any way to close the connection after the first wrong user/pass combination. So an attacker would be forced to reopen it? This would be perfect since an easy iptables/hashlimit would avoid such a brute force attack. Any other Ideas? Henry

8 21

[Dovecot] v1.2.rc5 released
by Timo Sirainen 05 Jun '09

05 Jun '09

http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc5.tar.gz http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc5.tar.gz.sig Some small fixes mainly. I guess I'll still have to release rc6 and rc7 after all. I've been a bit busy with v2.0 changes recently. BTW. I'm leaving tomorrow to San Francisco and I'm going to check out what's happening in Apple WWDC next week. * auth_cache_negative_ttl is now used also for password mismatches (currently only with plaintext authentication mechanisms). + Added support for EXTERNAL SASL mechanism. + FETCH X-SAVEDATE can now be used to get messages' save timestamps + deliver_log_format: %s is now in UTF8 - If message body started with a space, some operations could have assert-crashed. - Fixed using LDAP support as a plugin - Fixes to virtual mailboxes.

2 2

[Dovecot] ldap_search() failed "Server Busy"
by Paul Carter-Brown 05 Jun '09

05 Jun '09

Hi, We are using dovecot 1.1.11 on Solaris 10u6. Under load, we are experiencing the following errors: Jun 4 18:30:59 ug1s02-zone1 dovecot: [ID 107833 mail.error] auth(default): ldap(0202934816(a)ug.smilecoms.com,10.31.3.13): ldap_search() failed (filter (uid=0202934816(a)ug.smilecoms.com)) Server is busy We are authenticating against sun directory server yet see no errors in the directory server and it seems to be under low load. Any ideas if there is something on dovecot we should tune to erradicate this? We are running a web front end on top of dovecot and hence have a lot of login/logout happening as the user navigates around. I have included our config below: dovecot.conf: base_dir = /opt/csw/var/run/dovecot/ protocols = imap pop3 listen = * disable_plaintext_auth = no shutdown_clients = yes log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail ssl_listen = ssl_disable = yes login_dir = /opt/csw/var/run/dovecot/login login_chroot = yes login_user = dovecot login_process_size = 128 login_process_per_connection = no login_processes_count = 3 login_max_processes_count = 128 login_max_connections = 256 login_greeting = Dovecot ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_log_format = %$: %s mail_location = maildir:/sapool1/mail/%3n/%3.3n/%6.3n/%u mail_full_filesystem_access = yes mail_debug = no fsync_disable = yes first_valid_uid = 101 mail_save_crlf = yes mbox_dirty_syncs = yes protocol imap { login_executable = /opt/csw/libexec/dovecot/imap-login mail_executable = /opt/csw/libexec/dovecot/imap login_greeting_capability = no imap_client_workarounds = outlook-idle } protocol pop3 { login_executable = /opt/csw/libexec/dovecot/pop3-login mail_executable = /opt/csw/libexec/dovecot/pop3 pop3_no_flag_updates = no pop3_enable_last = no pop3_reuse_xuidl = no pop3_lock_session = no pop3_uidl_format = %v-%u pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s } protocol lda { postmaster_address = postmaster(a)example.com hostname = sol10-dev.dutoit.net } auth_anonymous_username = anonymous auth_verbose = no auth_debug = no auth_debug_passwords = no auth_worker_max_count = 30 auth default { mechanisms = plain passdb ldap { args = /opt/csw/etc/dovecot-ldap.conf } userdb static { args = uid=exim gid=mail home=/sapool1/mail/%u } user = root count = 1 ssl_require_client_cert = no ssl_username_from_cert = no socket listen { master { path = /opt/csw/var/run/dovecot/auth-master mode = 0600 user = root group = root } } } dict { } plugin { } dovecot-ldap.conf: hosts = ldap1.it.ug.smilecoms.com:389 dn = cn=Directory Manager dnpass = blahblah sasl_bind = no tls = no ldap_version = 3 base = dc=smilecoms,dc=com deref = never scope = subtree user_filter = (uid=%u) pass_attrs = uid=user,PIN=password pass_filter = (uid=%u) default_pass_scheme = PLAIN Thanks so much! Paul

2 3

[Dovecot] Under POP attack - now to prevent?
by James Brown 05 Jun '09

05 Jun '09

Looks like we are under a dictionary login attack on our POP server: Jun 5 11:48:20 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:25 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<austin>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:27 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:28 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:30 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:31 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:31 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<austin>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:32 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<atlanta>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Any suggestions on how to prevent this? Using Dovecot 1.2RC4 Thanks, James.

5 5

[Dovecot] feature request - zlib compression via LDA
by J.P. Trosclair 04 Jun '09

04 Jun '09

Any chance of getting compression support via the zlib plugin for dovecot deliver in future versions?

2 4

[Dovecot] imapmagicplus equivalent?
by Juergen Kreileder 04 Jun '09

04 Jun '09

Hi, is anything like Cyrus IMAP's imapmagicplus option available for Dovecot? If not, would it be possible to implement as a plugin? > imapmagicplus: 0 > Only list a restricted set of mailboxes via IMAP by using userid+namespace syntax as the authentication/authorization id. Using userid+ (with an empty namespace) will list only subscribed mailboxes. It's a quite useful option for clients that don't understand subscriptions. E.g., I don't want to see all of my folders on my iPhone, by using userid+ I can limit them to a useful set. Juergen

2 1

[Dovecot] deleteing label (cheating crackers)
by Mohsen Pahlevanzadeh 04 Jun '09

04 Jun '09

Dear all, When i telnet to my server, I see following things: [root@daka ~]# telnet 0 110 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. +OK Dovecot ready. Now i want to delete Dovecot word & put my word. How i do? Yours, Mohsen

3 2

[Dovecot] Password environment variable - logging the password
by Donovan Craig 04 Jun '09

04 Jun '09

Hi, We¹re migrating to a Cpanel hosting system. Our passwords are currently stored in MD5. I looked at the post login scripting to be able to start storing the plain text passwords as people login temporarily so we can automate our migration. It seems that the password is not available in the post login environment variables. Is there any way we can get access to the plain text password upon login so we can insert this into our user table? Best regards, Donovan

3 2

[Dovecot] Some questions about deliver
by Axel Luttgens 04 Jun '09

04 Jun '09

While investigating Dovecot's deliver with Postfix, I encountered some behaviors making me wonder whether I really understand the purpose of that binary. So, if you allow... This is from Postfix' main.cf: mailbox_command = /usr/local/dovecot/libexec/dovecot/deliver -e -n This is my quick setup for Dovecot: # 1.2.rc4: /usr/local/etc/dovecot.conf # OS: Darwin 9.7.0 i386 protocols: pop3 ssl: no disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/dovecot-1.2.rc4/libexec/dovecot/pop3- login first_valid_uid: 2001 mail_location: mbox:~/_mailboxes:INBOX=~/_inbox/mailspool mbox_read_locks: flock mbox_write_locks: flock dotlock mail_executable: /usr/local/dovecot-1.2.rc4/libexec/dovecot/pop3 mail_plugin_dir: /usr/local/dovecot-1.2.rc4/lib/dovecot/pop3 pop3_lock_session: yes pop3_uidl_format: %08Xv%08Xu auth default: passdb: driver: pam args: * userdb: driver: passwd Here is an excerpt from mail.log: postfix/smtpd[4117]: connect from localhost[127.0.0.1] postfix/smtpd[4117]: 163E1CA2675: client=localhost[127.0.0.1] postfix/cleanup[4120]: 163E1CA2675: message-id=<27002A3F-AF44-410D-A500-368D04F5FA9A(a)almbp.local > postfix/qmgr[3232]: 163E1CA2675: from=<testuser(a)almbp.local>, size=2650, nrcpt=1 (queue active) dovecot[4129]: deliver(www): mail_location: mbox: mkdir(/Library/ WebServer/_mailboxes) failed: Permission denied (euid=70(_www) egid=70(_www) missing +w perm: /Library/WebServer) dovecot[4129]: deliver(www): Fatal: Namespace initialization failed postfix/local[4122]: 163E1CA2675: to=<www(a)almbp.local>, relay=local, delay=0.09, delays=0.02/0/0/0.07, dsn=4.3.0, status=deferred (temporary failure) postfix/smtpd[4117]: disconnect from localhost[127.0.0.1] 1. Shouldn't deliver honor the first_valid_uid setting? After all, if some user isn't allowed to login, is that user supposed to receive mail? 2. What exactly is the -e option supposed to do? User _www clearly isn't configured for receiving mail, but Postfix will nevertheless try to deliver the message until maximal_queue_lifetime has expired. From the log excerpt, it appears that Postfix has been led to consider a temporary failure; unless I'm wrong, that's because Postfix didn't receive neither a "D.S.N text" string nor an EX_* fatal return code. From deliver.c, it seems that many calls to i_fatal() are liable to be executed before the -e option is taken into account (through the local variable stderr_rejection). As a result, I'm wondering under which circumstances exactly deliver is liable to return EX_NOPERM, so that Postfix may consider a permanent failure and bounce the message. Note that the question may somehow be re-phrased as: when invoked without the -e option, under which circumstances will deliver send a rejection message? 3. Doesn't failure_exit_callback() in deliver.c tend to merge many (possibly dissimilar) errors into the single EX_TEMPFAIL one? And BTW, is that function guaranteed to be always called with an EX_* value? Seems to be the case, but... ;-) TIA for your patience, Axel

2 5

[Dovecot] Maildir compression utility
by John Fawcett 04 Jun '09

04 Jun '09

Does anyone know of a script to compress old mails stored in a maildir format by carrying out the steps described at http://wiki.dovecot.org/Plugins/Zlib thanks, John

2 2