- dovecot - dovecot.org

Username character disallowed by auth_username_chars: 0x13
by Alex 30 Nov '17

30 Nov '17

Hi, I'm receiving the following messages in my mail logs that I haven't seen before: Nov 28 22:45:31 bwipropemail dovecot: auth: login(?,179.210.41.21): Username character disallowed by auth_username_chars: 0x13 (username: AB?) Nov 28 22:45:31 bwipropemail dovecot: auth: login(?,179.210.41.21): Username character disallowed by auth_username_chars: 0x13 (username: AB?) There's thousands of them, from hundreds of different IP addresses. I suspect it's an exploit attempt, but does anyone know which? I've added a fail2ban entry, but I'd also like to make sure my dovecot is not vulnerable. This is on a fc25 system with all updates.

2 2

Detect port number of SASL AUTH request?
by MRob 30 Nov '17

30 Nov '17

Hi, this is partly Postfix related, but I want to know if there could be way to distinguish port of the SASL AUTH request to segregate user services. Currently I use unix listener for dovecot sasl auth, but could change to inet_listener. Only way I can think is to have different SASL AUTH services for each master.cf entry where its needed. But is it possible for Dovecot to have more than one SASL AUTH services with different configuration setup? It would be nicer if there was a way for Postfix to tell Dovecot about the port the client connected on. Or maybe it can be done with a SASL realm? I'm not sure how? Any help please?

2 1

Plugin 'sieve_imapsieve' not found
by Christopher Satchell 30 Nov '17

30 Nov '17

Hello, when Dovecot launches (and pretty much at any action afterwards) it always throws following error: | managesieve: Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib/dovecot/modules/sieve | config: Error: managesieve-login: dump-capability process returned 89 dovecot-sieve and dovecot-managesieved are both installed and the only plugin in the mentioned folder is `lib90_sieve_extprograms_plugin.so`. `doveconf -n` output: # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) managesieve(username): Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib/dovecot/modules/sieve doveconf: Error: managesieve-login: dump-capability process returned 89 # OS: Linux 4.4.0-101-generic x86_64 Ubuntu 16.04.3 LTS auth_mechanisms = plain login mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_privileged_group = vmail mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.domain.tld/fullchain.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/mail.domain.tld/privkey.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " sieve" postmaster_address = postmaster(a)domain.tld } Thanks in advance. Chris

3 3

dovecot - 2 Faktor Auth
by Hajo Locke 30 Nov '17

30 Nov '17

Hallo Liste, hat sich schon mal jemand mit 2 Faktor Auth für dovecot beschäftigt? Es geht dabei nicht nur um die Absicherung einer Weboberfläche sondern direkt die Absicherung der Standard pop/imap Verbindungen des Clients. Wir machen das auth bisher über MySQL. Rein technisch würde das gehen, da man die Password-Query beliebig anpassen und auch mit allow_nets arbeiten kann. Es wäre eher die Herausforderung für den Client den 2. Faktor zu erfüllen und seine IP freizuschalten. Man müsste dann ja Clients wie Thunderbird veranlassen irgendwie die Challenge des 2. Faktors anzuzeigen und zu erfüllen. Vermutlich kann man das nur mit speziellen Clients z.B. einer eigenen App machen. Hat jemand in dem Bereich Erfahrung und kann diese teilen? Danke, Hajo

2 1

ManageSieve: authenticate "EXTERNAL" not behaving correctly
by Marc Weustink 30 Nov '17

30 Nov '17

Hi, I've enabled client certificate authentication for imap and managesieve. When I use Thunderbird with the sieve plugin it tries to login, but times out. Initially I reported this to the sieve plugin, but we came to the conclusion that it managesieve is misbehaving. https://github.com/thsmi/sieve/issues/94 Thunderbird (win10-64) 52.4.0 (32bit) Sieve 0.2.3k Dovecot (Ubuntu 16.04.3 LTS) 2.2.33.1-1 (sid) What happens is the following (p=plugin sends m=managesieve sends) p:authenticate "EXTERNAL" "" m:"" The response is unexpected. According to RFC 5804 an empty challenge/response is sent as an empty string. So I would expect: p:authenticate "EXTERNAL" "" m:OK "Logged in." With the use of gnutls-cli I could reproduce (c=I send m=managesieve sends) gnutls-cli --starttls --x509keyfile marc_mail.key --x509certfile marc_mail.crt -p sieve 172.17.1.4 ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "" m:"" c:"" m:OK "Logged in." However if I try the "imap" syntax (rfc4959) I get logged in at once ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "=" m:OK "Logged in." Note that this is an imap only extention, "=" is an invalid base64 encoding. Marc

2 4

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

On 30/11/17 03:03, Robert Giles wrote: >> David, >> >> I'd say that if you set the mail_max_userip_connections value to a >> large-ish number (300-400), your users likely won't notice an issue on >> their iOS 10.x and iOS 11.x devices.? It's more of an annoyance in the >> logs, and occasionally the iOS Mail app will show that it is stuck >> checking mail for a few minutes (when the new max_userip_connections is >> reached again, but with a large number, it happens much less frequently). >> >> Keep in mind max_userip applies to *authenticated* users, so a true, >> malicious DoS situation is less likely. Maybe not malicious DoS, but if your running a shared platform, or supports hundreds of users using Apple products, you can do the arithmetic and see that you can run into problems with resource starvation. >> And yeah, I'm definitely tired of Apple going off and breaking their >> software, because the blame always comes back on IT instead of Apple :( Apple, are you listening? Would it kill you to design your software not to treat remote mail servers like personal servers that can serve up connections like candy? (I also see that some iOS clients keeps an open SMTP connection on standby, even though it's not sending mail.) Joseph Tam <jtam.home(a)gmail.com>

1 0

iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

I frequently see this from my iPhone/iPad IMAP users: Oct 24 21:30:55 server dovecot: imap-login: Login: user=<user>, ... [... repeated 10 times ...] Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> Oct 24 21:32:54 server dovecot: imap(user): Logged out ... [... repeated 11 times ...] These bursts of logins/max/logouts would cycling on for a few minutes. Googling this problem seems to turn up lots of similar complaints about iOS mail mail clients. e.g. https://discussions.apple.com/thread/2547839?tstart=0 iOS mail readers do not limit connections limit as other mailreaders can. I could increase mail_max_userip_connections, but that just moves the goal posts. Using the new rawlog feature in 2.2.26 (thanks Dovecot team!), I was able to see that these connection bursts are caused by clients doing global searches. The rawlogs show each mailbox being SELECT'd and searched (e.g. From header string): 1477369968.730450 2 ID ("name" "iPad Mail" "version" "13G36" "os" "iOS" "os-version" "9.3.5 (13G36)") 1477369968.781932 3 SELECT {mailbox} 1477369968.961636 4 UID SEARCH RETURN (COUNT) 1:* NOT DELETED 1477369969.006087 5 UID SEARCH RETURN (ALL) 1:* NOT DELETED 1477369969.052701 6 UID SEARCH RETURN (ALL) {search-term} NOT DELETED 1477369974.624153 7 LOGOUT Questions: 1) How does this affect the user? I heard from one user that it makes global searches unusable because his reader just spins its wheel. I'm not sure whether this is impatience or this results in failed searches. 2) Is there a client-side fix (e.g. connection limiting)? Apple appears to be intransigent on addressing this. 3) Will maintaining search indices (e.g. solr) help with this? Maybe the searches are taking too long and the connections pile up waiting for previous searches to finish. Thanks, Joseph Tam <jtam.home(a)gmail.com>

3 2

XDOVECOT capability?
by Hogne Vevle 28 Nov '17

28 Nov '17

Hi! Here and there, I'm seeing mentions of a "XDOVECOT" capability - e.g. on https://documentation.open-xchange.com/7.8.2/middleware/components/search/c… . However, I can't seem to find any documentation on what this actually does. We need to add this capability to our servers in order for certain functionality of Open Xchange App Suite to work properly (as seen in the link above), but we don't want to blindly update our entire Dovecot cluster just because their docs tell us to :) Can someone, please, shed some light on what other effects we can expect to see after enabling this capability, if any? Or is it simply a way of telling clients that "Hey, I'm a Dovecot server" - nothing else? Cheers, - Hogne

2 1

How to make dovecot access a MySQL database with a certain domain?
by Spike98 28 Nov '17

28 Nov '17

I am trying to make a mail server with Postfix using the Dovecot software. At the time of wanting to access my server from a mail client, it does not let me access and see the logs of my server with the command: $ service dovecot status with the following error: dovecot: auth-worker(2769): Error: mysql(127.0.0.1): Connect failed to database (postfix): Access denied for user 'postfix'@'localhost' (using password: YES) - waiting for 125 seconds before retry From what I understand of this error is that it is trying to enter 'postfix' @ 'localhost' instead of the domain that I specify when I made the database that is mydomain.com How can you make dovecot go to MySQL with postfix(a)mydomain.com instead of localhost This is my Dovecot configuration /etc/dovecot/dovecot-sql.conf.ext driver=mysql default_pass_scheme=PLAIN-MD5 connect=host=127.0.0.1 dbname=postfix user=postfix password=postfix password_query=SELECT username,domain,password FROM usuarios WHERE username='%n' AND domain='%d' user_query=SELECT 1007 as uid, 1007 as gid, concat("maildir:/var/vmail",domain,'/',username,'/') as mail FROM usuarios WHERE username='%n' AND domain='%d' iterate_query=SELECT username,domain FROM usuarios

3 2

Imapsieve plugin?
by Bruce 28 Nov '17

28 Nov '17

Debian stretch. Dovecot 2.2.27 I was working with a document that references the imapsieve plugin. It references the /etc/dovecot/conf.d/90-imapsieve.conf file. The only reference I've found for it is https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/IMAPSieve#Configuration. I've got dovecot-managedsieve and dovecot-sieve already installed. Am I missing something obvious here? Bruce M.

2 2