- dovecot - dovecot.org

Re: detect suspicious logins
by Joseph Tam 21 Dec '17

21 Dec '17

Matthew Broadhead <matthew.broadhead(a)nbmlaw.co.uk> wrote: >> does anyone know of a linux module (maybe similar to fail2ban) that >> could be installed which would monitor email logs (sign ins) and alert >> the user to any suspicious activity on their account? I just monitor straight from the logs using homebrew utilties. @lbutlr" <kremels(a)kreme.com> > Fail2ban can protect email logins. Alerting a user because random IP > in Korean Middle School tried to login seems no helpful. > >> i suspect it would need to log geo location, device type and ip >> address to a database. it seems like a module like this would be very >> useful > > How? > > Blacklist failed logins. That protects everyone and doesn't induce panic. I just went through a long thread elsewhere on this topic. Fail2ban is mainly a counter brute force measure. If you have a strong password policy, the net result of using it is that it makes your logs smaller, and maybe saves some CPU cycles or from DoS for really intense bouts, but otherwise, does not add to security as good passwords makes BFD infeasible. *However*, if the attacker knows the approximate password (e.g. shoulder surfing), this may help, but eventually, the password will succumb to a patient diligent attack. What the OP is considering is if the password is divulged e.g. phishing attack or snarfed from another source. In this case, an intruder's authentication will succeed immediately. If a monitor spots someone authenticating from another continent than where the owner is supposed to be, or from 2 locations thousands of miles apart, or from 5 different location simultaneously, or tried to send a huge number of messages with many bounces, or was using a different mail clients that one historically used), it can signal the admin/user for further investigation. For users, I think reporting a login origin audit will be helpful, regardless of circumstances. However, it should be done out of band, if the assumption is someone else has control of the account. Joseph Tam <jtam.home(a)gmail.com>

1 0

Logouts/disconnections not being logged?
by Joseph Tam 21 Dec '17

21 Dec '17

In a previous thread Subject: Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded I reported the behaviour of MacOSX/iOS IMAP readers whereby it would use up all available connections (up to the mail_max_userip_connections setting) for mailbox searches, then log them all out, then repeat the cycle with another batch of mailbox searches, until all mailboxes were scanned. However, login/logout log counts don't square up. I would observe (for a particular user+ip) mail_max_userip_connections login entries, followed by *fewer* than mail_max_userip_connections logout entries. (I could not find any disconnections or other forms of termination.) The next peak connection count happened after another mail_max_userip_connections logins (implying the total connection count > mail_max_userip_connections), then another strings of logouts fewer than mail_max_userip_connections. For example, if mail_max_userip_connections=100, I would see 0 -> 100 logins -> 87 logouts -> 100 logins -> 87 logouts -> 100 logins -> 94 logouts -> 100 logins -> ... It appears that somewhere, somehow, IMAP session exits are not being logged. Is there a reason to explain this discrepancy? Joseph Tam <jtam.home(a)gmail.com>

1 0

Virtual folders: Panic: file mail-index-sync.c
by Andreas Tauscher 21 Dec '17

21 Dec '17

Hi! I have compiled Dovecot 2.33.2 and crated some virtual folders. When I create a virtual folder for all flagged mails with dovecot-virtual containing * flagged and I set in 15-mailboxes.conf mailbox virtual/Flagged { special_use = \Flagged comment = All flagged messages auto = subscribe } The dovecot is crashing when any virtual folder is accessed: Dec 21 01:07:59 mail dovecot: imap(transfer1(a)shidolya.co.tz): Panic: file mail-index-sync.c: line 413 (mail_index_sync_begin_to2): asserti on failed: (!index->syncing) Dec 21 01:07:59 mail dovecot: imap(test(a)test.local): Error: Raw backtrace:/usr/lib/dovecot/libdovecot.so.0(+0x935c2) [0x7f4ead13 95c2] -> /usr/lib/dovecot/libdovecot.so.0(+0x936ad) [0x7f4ead1396ad] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4ead0c9f61] -> /u sr/lib/dovecot/libdovecot-storage.so.0(+0xd4d4c) [0x7f4ead49ed4c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_begin_to+0x4 f) [0x7f4ead49ee2f] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_begin+0x1c) [0x7f4ead49eecc] -> /usr/lib/dovecot/modules/l ib20_virtual_plugin.so(virtual_storage_sync_init+0x20e) [0x7f4eabe9904e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x4 4) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage .so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /us r/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xd825) [0x7f4eac8d0825] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) [0x7f4ead407ae1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so (virtual_storage_sync_init+0x1096) [0x7f4eabe99ed6] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xd825) [0x7f4eac8d0825] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) [0x7f4ead407ae1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x1096) [0x7f4eabe99ed6] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f4ead4076a4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f4ead407747] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x31) [0x7f4ead481dd1] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x916d) [0x7f4eabe9616d] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x9ce81) [0x7f4ead466e81] When I remove "auto = subscribe" everything working like expected. I got this crash only if I use "flagged" in the virtual folder. Other virtual folders like a unseen folder is working fine with "auto = subscribe" Andreas

1 0

ot: fail2ban dovecot setup
by voytek＠sbt.net.au 20 Dec '17

20 Dec '17

I'm trying to setup and test fail2ban with dovecot I've installed fail2ban, I've copied config from https://wiki2.dovecot.org/HowTo/Fail2Ban, and, trying to test it, attempted multiple mail access with wrong password, but, get this: # fail2ban-client status dovecot-pop3imap Status for the jail: dovecot-pop3imap |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/dovecot.log `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: # grep 'auth fail' /var/log/dovecot.log | grep voytek@k | wc 19 367 3749 and Dec 17 09:55:03 imap-login: Info: Disconnected (auth failed, 2 attempts in 5 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<bQ6mAX1gHcRur/an> Dec 17 09:55:12 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<Osk5An1gAKVur/an> Dec 17 09:55:20 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<xsq/An1gDN1ur/an> Dec 17 09:55:27 imap-login: Info: Disconnected (auth failed, 2 attempts in 4 secs): user=<voytek@k..au>, method=PLAIN, rip=110.175.246.167, lip=163.47.110.7, TLS, session=<RVUkA31gm4xur/an> # cat dovecot-pop3imap.conf [Definition] failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.* ignoreregex = # systemctl status fail2ban ● fail2ban.service - Fail2Ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled) Active: active (running) since Sat 2017-12-16 22:35:14 AEDT; 12h ago Docs: man:fail2ban(1) Process: 2034 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS) Process: 6024 ExecReload=/usr/bin/fail2ban-client reload (code=exited, status=0/SUCCESS) Process: 2036 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=0/SUCCESS) Main PID: 2039 (fail2ban-server) CGroup: /system.slice/fail2ban.service └─2039 /usr/bin/python2 -s /usr/bin/fail2ban-server -s /var/run/fail2ban/fail2ban.sock -p /var/ru... Dec 16 22:35:14 systemd[1]: Starting Fail2Ban Service... Dec 16 22:35:14 fail2ban-client[2036]: 2017-12-16 22:35:14,657 fail2ban.server [2...9.7 Dec 16 22:35:14 fail2ban-client[2036]: 2017-12-16 22:35:14,657 fail2ban.server [2...ode Dec 16 22:35:14 systemd[1]: Started Fail2Ban Service. Dec 17 09:21:51 systemd[1]: Reloaded Fail2Ban Service. Dec 17 09:22:52 systemd[1]: Reloaded Fail2Ban Service. Dec 17 09:31:40 systemd[1]: Reloaded Fail2Ban Service. Hint: Some lines were ellipsized, use -l to show in full.

4 8

Shared mailboxes ACL's in MySQL, mailboxes in LDAP
by Matt . 20 Dec '17

20 Dec '17

Hi Guys, I'm having a situation that I want to autocreate my mailboxes using ldap auth as my mailboxes are in there. But as I need to share some mailboxes as shared folder is it possible to have that information in MySQL ? Maybe it even better to put everything in MySQL but designwise it's actually not. I f someone has an example how to accomplish this as I'm reading about ACL's as well and I'm wondering if this is actually going to work. Thanks! Matt

1 0

POP3 lock
by The Doctor 19 Dec '17

19 Dec '17

This might be trivial or not. I have a customer access his e-mail via POP3 using multiple devs. I recommend they switch to IMAP , however, How can the POP3 locking be made into a non-issue? -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Happy Christmas 2017 and Merry New Year 2018

2 1

IMAP proxy
by Gandalf Corvotempesta 19 Dec '17

19 Dec '17

I'm migrating an old server to another old server (same dovecot version in both servers) The migration itself is straightforward, stop dovecot on the old server, migrate everything via rsync, start dovecot to the new server. There is only one step left: change the dns configuration, pointing from the old server to the newer one. As most of domains are not managed by me and some other domains are pointing to our server via IP, I can't simply change the A record or wait for all users to change their domain configuration. TL;DR: is possible to use dovecot as IMAP proxy so that even after changing our dns records, any user directly connecting to my old server would be proxied to the newer one automatically ? Any additional software or only a configuration change is required ?

3 3

Panic: file-lock.c
by Ricardo Branco 19 Dec '17

19 Dec '17

Today we had an unclean shutdown of our NFS filler and have had lots of issues with mailboxes being re-synced, mostly all the issues are now resolved but we are seeing the following appear for one user on our system. Dec 19 16:15:29 imap(xxx.xxx@xxx.com)(xxx.xxx@xxx.com): Panic: file file-lock.c: line 287: unreached Dec 19 16:15:29 imap(xxx.xxx@xxx.com)(xxx.xxx@xxx.com): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x9ceda) [0x7f2b45209eda] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x9cf46) [0x7f2b45209f46] -> /usr/local/lib/dovecot/libdovecot.so.0(i_error+0) [0x7f2b4519cc5f] -> /usr/local/lib/dovecot/libdovecot.so.0(+0xa150a) [0x7f2b4520e50a] -> /usr/local/lib/dovecot/libdovecot.so.0(file_wait_lock_error+0x39) [0x7f2b4520e789] -> /usr/local/lib/dovecot/libdovecot.so.0(file_try_lock_error+0x13) [0x7f2b4520e873] -> /usr/local/lib/dovecot/libdovecot.so.0(file_create_locked+0x29e) [0x7f2b4520b7de] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_lock_file_create+0x125) [0x7f2b454dc345] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0xba1fd) [0x7f2b4554f1fd] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_mailbox_vsize_update_appends+0x63) [0x7f2b4554f363] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_mailbox_sync_deinit+0x197) [0x7f2b4555c327] -> /usr/local/lib/dovecot/lib20_fts_plugin.so(+0xebd1) [0x7f2b4416bbd1] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_deinit+0x30) [0x7f2b454de750] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x3b) [0x7f2b454e0b4b] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x62) [0x7f2b45558402] -> /usr/local/lib/dovecot/lib20_fts_plugin.so(+0xfbf4) [0x7f2b4416cbf4] -> /usr/local/lib/dovecot/lib01_acl_plugin.so(+0xe564) [0x7f2b445aa564] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x8c) [0x7f2b454e05cc] -> dovecot/imap(imap_status_get+0x7a) [0x42222a] -> dovecot/imap(cmd_status+0x15d) [0x41514d] -> dovecot/imap(command_exec+0x5d) [0x41a7fd] -> dovecot/imap() [0x417fb0] -> dovecot/imap() [0x418046] -> dovecot/imap(client_handle_input+0x165) [0x418385] -> dovecot/imap(client_input+0x6f) [0x41882f] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x61) [0x7f2b4521db71] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xbf) [0x7f2b4521f75f] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) [0x7f2b4521dc2c] Dec 19 16:15:29 imap(xxx.xxx@xxx.com)(xxx.xxx@xxx.com): Fatal: master: service(imap): child 30620 killed with signal 6 (core dumps disabled)

1 0

Released Pigeonhole v0.5.0.rc1 for Dovecot v2.3.0.rc1.
by Stephan Bosch 19 Dec '17

19 Dec '17

Hello Dovecot users, Here is the Pigeonhole release candidate that goes with the Dovecot v2.3 release candidate. Of course, a large part of this release consists of compatibility changes for Dovecot v2.3. Apart from that, not much changed, just a few additions and fixes that accumulated over the last few months. Most of these changes will be back-ported to Pigeonhole v0.4, but that release will happen a little later. Changelog v0.5.0: * editheader extension: The implementation of header modifications is heavily updated. Although the functionality has not changed, the underlying code was updated to address several static analysis warnings, runtime integer arithmetic warnings (Clang), and to match updates in the Dovecot stream API. + variables extension: Made the maximum scope and variable size configurable. + subaddress: Support multiple recipient_delimiters. - enotify extension: mailto method: Fixed parsing of mailto URI with only a header part. - enotify plugin: mailto method: Make sure the "From:" header is set to a usable address and not "(null)". - Fixed writing address headers to outgoing messages. Sometimes headers were MIME-encoded twice, yielding invalid results. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.0.… http://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.0.… Refer to http://pigeonhole.dovecot.org and the Dovecot wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

3 3

nfs_flush_chown_uid errors over NFS
by Johan Hendriks 18 Dec '17

18 Dec '17

Hello all, We use an older version of dovecot 2.0.19 on Ubuntu 12.04 using an NFS share, also a linux box. Now we want to migrate the storage to a FreeBSD server and later on the mailservers them self. In the firsts test all looks fine, but we do see some errors some times. Error: nfs_flush_chown_uid: chown(/var/mail/virtual/domain.com/user/Maildir) failed: Invalid argument This does not happen all the time but sometimes it shows up. I can read all the mail using an mailclient and the uid shows the user vmail:vmail. Is this cosmetic or is there something wrong? Thanks for your time Regards johan

1 0