- dovecot - dovecot.org

fsck looping duplicate mdbox GUIDs
by Dirk Koopman 01 Jul '17

01 Jul '17

I have recently updated with 2.2.29.1-avh1~xenial1 ubuntu package on 16.04. It appears that I have a couple of duplicate GUIDs which fsck can't clear so the machine is looping through doing continuous fsck runs. Any way to determine what the offending messages are and how to delete or otherwise stop this? Jul 1 17:09:24 post dovecot: doveadm(djk(a)tobit.co.uk): Warning: fscking index file /home/imap/djk/storage/dovecot.map.index Jul 1 17:09:24 post dovecot: doveadm(djk(a)tobit.co.uk): Error: Fixed index file /home/imap/djk/storage/dovecot.map.index: log_file_tail_offset 0 -> 24 Jul 1 17:09:24 post dovecot: dsync-local(djk): Warning: fscking index file /home/imap/djk/storage/dovecot.map.index Jul 1 17:09:24 post dovecot: doveadm(djk(a)tobit.co.uk): Warning: fscking index file /home/imap/djk/storage/dovecot.map.index Jul 1 17:09:25 post dovecot: doveadm(djk(a)tobit.co.uk): Warning: mdbox /home/imap/djk/storage: rebuilding indexes Jul 1 17:10:15 post dovecot: dsync-local(djk): expunge: box=mup-users, uid=1528, msgid=<48707D70.9070108(a)optusnet.com.au>, size=3159 Jul 1 17:11:00 post dovecot: doveadm(djk(a)tobit.co.uk): Error: mdbox /home/imap/djk/storage: Duplicate GUID a8e15732b4f91b55414f0000f80b9cab in m.385:10102880 (size=860) and m.100:3388046 (size=861) Jul 1 17:11:11 post dovecot: doveadm(djk(a)tobit.co.uk): Error: mdbox /home/imap/djk/storage: Duplicate GUID 67d2801030161c557a710000f80b9cab in m.389:363061 (size=895) and m.169:5349813 (size=896) Jul 1 17:11:43 post dovecot: doveadm(djk(a)tobit.co.uk): Warning: Transaction log file /home/imap/djk/storage/dovecot.map.index.log was locked for 139 seconds (mdbox storage rebuild) Jul 1 17:11:43 post dovecot: dsync-local(djk): Warning: Locking transaction log file /home/imap/djk/storage/dovecot.map.index.log took 88 seconds (syncing) Jul 1 17:11:43 post dovecot: doveadm(djk(a)tobit.co.uk): Warning: fscking index file /home/imap/djk/storage/dovecot.map.index Dirk

1 0

uid '0' from fts_solr?
by Larry Rosenman 30 Jun '17

30 Jun '17

I'm getting lots of: Jun 30 14:41:34 thebighonker dovecot: imap(ler/14135): Error: fts_solr: received invalid uid '0' in my logs. Ideas? doveconf -n: # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-BETA2 amd64 auth_default_realm = lerctr.org auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org auth_username_format = %Ln default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service indexer-worker { drop_priv_before_exec = yes } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

1 0

Auth Policy Server
by Daniel Miller 30 Jun '17

30 Jun '17

I've made a preliminary auth policy server in Perl - and it sort of works (mostly) - but I've got some questions on "proper" implementation. It appears the communication is HTTP based - is the intent to talk to a "proper" webserver, or is a simple dedicated daemon appropriate (which is what I made)? Should connections be maintained, or terminated after each response (which is my current setup)? If my implementation is correct, I may have found a bug, as I have some log entries like: Jun 30 08:24:20 bubba dovecot: imap-login: Warning: Auth connection closed with 1 pending requests (max 31 secs, pid=10253, EOF) Jun 30 08:24:20 bubba dovecot: auth: Fatal: master: service(auth): child 31631 killed with signal 11 (core dumped) Guidance would be appreciated. -- Daniel

2 3

imapc making too any connections
by van der Kamp, John 30 Jun '17

30 Jun '17

Hi, I was testing around with 2.2.31, and saw that it made new extra connections to the backend imap server whenever you make a new mailbox. So client does: A001 login username password A002 create subfolder Previously, dovecot would just send the create command to the backend, but now does (including connection IDs): [conn1] 9 CREATE "subfolder" [conn1] 10 EXAMINE "INBOX" [conn2] 12 LOGIN "username" "password" [conn2] 11 SELECT "subfolder" The new EXAMINE Command is a bit weird, but the secondary connection is a complete waste. I also haven't seen any other action on it yet, but it's kept around. If you make more mailboxes, every time you gain an extra connection from dovecot to the backend imap server. And they all stick around. I don't know which changes this behavior triggered, there were loads of imapc fixes the last couple of releases. John

2 1

sieve/vacation: bad parsing of 'References' header
by Krzysztof Witek 29 Jun '17

29 Jun '17

Hello there, I see a strange behavior in the sieve plugin. If I send an email containing the 'References' field with multiple values like this: References: <56CF3A8E.3060603(a)email.com> <74cc03f4-899f-e76f-81ea-d0e8a0efce9e(a)email.com> <CY1PR1001MB11630EC0D1DD48FBB12DDAC1DE090(a)CY1PR1001MB1163.namprd10.prod.outlook.com> <db3ee17f-33eb-b15c-8599-60b6dfa623e0(a)email.com> <YTXPR01MB01112EB28C7BECB5A5EF14C5DEE10(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <734f9013-c4a2-eab4-9c0d-2cfc3deafaee(a)email.com> <YTXPR01MB0111660D7D5A73451F3E5B66DEE00(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <9e3e3c00-a0d8-c061-7c7e-20e660533264(a)email.com> <e702bae4-b1d1-6671-fa74-87349282ce46(a)email.com> <YTXPR01MB01119930E4D876F91008D465DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <69c6be47-b17f-9f9a-5a0c-f389c6877f82(a)email.com> <YTXPR01MB01116BC86CBA49677A29C607DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB0111564E38C21BB293DCAE97DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB01117A258CD09E1E84A1CBC1DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> The vacation sieve script will add extra line breaks into the reply email as follows: References: <56CF3A8E.3060603(a)email.com> <74cc03f4-899f-e76f-81ea-d0e8a0efce9e(a)email.com> <CY1PR1001MB11630EC0D1DD48FBB12DDAC1DE090(a)CY1PR1001MB1163.namprd10.prod.outlook.com> <db3ee17f-33eb-b15c-8599-60b6dfa623e0(a)email.com> <YTXPR01MB01112EB28C7BECB5A5EF14C5DEE10(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <734f9013-c4a2-eab4-9c0d-2cfc3deafaee(a)email.com> <YTXPR01MB0111660D7D5A73451F3E5B66DEE00(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <9e3e3c00-a0d8-c061-7c7e-20e660533264(a)email.com> <e702bae4-b1d1-6671-fa74-87349282ce46(a)email.com> <YTXPR01MB01119930E4D876F91008D465DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <69c6be47-b17f-9f9a-5a0c-f389c6877f82(a)email.com> <YTXPR01MB01116BC86CBA49677A29C607DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB0111564E38C21BB293DCAE97DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB01117A258CD09E1E84A1CBC1DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <d0e5c311-bc89-c085-d597-f3a5744edd59(a)email.com> The problem is this is rendered as follows in the email client (this is what a user will see when he/she receives the auto reply): <CY1PR1001MB11630EC0D1DD48FBB12DDAC1DE090(a)CY1PR1001MB1163.namprd10.prod.outlook.com> <db3ee17f-33eb-b15c-8599-60b6dfa623e0(a)email.com> <YTXPR01MB01112EB28C7BECB5A5EF14C5DEE10(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <734f9013-c4a2-eab4-9c0d-2cfc3deafaee(a)email.com> <YTXPR01MB0111660D7D5A73451F3E5B66DEE00(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <9e3e3c00-a0d8-c061-7c7e-20e660533264(a)email.com> <e702bae4-b1d1-6671-fa74-87349282ce46(a)email.com> <YTXPR01MB01119930E4D876F91008D465DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <69c6be47-b17f-9f9a-5a0c-f389c6877f82(a)email.com> <YTXPR01MB01116BC86CBA49677A29C607DE3A0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB0111564E38C21BB293DCAE97DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <YTXPR01MB01117A258CD09E1E84A1CBC1DECA0(a)YTXPR01MB0111.CANPRD01.PROD.OUTLOOK.COM> <d0e5c311-bc89-c085-d597-f3a5744edd59(a)email.com> Auto-Submitted: auto-replied (vacation) Precedence: bulk MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit I am on holydays right now. I will revert to you ASAP..... I can reproduce this bug on the version 2.2.9 of managersieve/dovecot. Does anyone know how to fix this? Thank you. Krzysztof Witek

3 9

Error: vsize-hdr has invalid size
by Robert Fantini 29 Jun '17

29 Jun '17

version 2.2.27 (c0f36b0) For one user logs have a lot of these since recent upgrade from debian jessie to stretch : Jun 28 13:08:18 imap dovecot: imap(tfa): Error: vsize-hdr has invalid size: 36 Only one user has the issue. It has been happening for a month, The user reports no issue on his end reading mail. Is there a way to fix the error ? best regards, Roberto # dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-3-amd64 x86_64 Debian 9.0 auth_mechanisms = plain login auth_username_format = %Ln lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_location = maildir:~/Maildir mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-ldaps.conf.ext driver = ldap } plugin { mail_plugins = quota sieve sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/spam.sieve sieve_dir = ~/sieve sieve_global_dir = /etc/dovecot/sieve/ } postmaster_address = . protocols = " imap lmtp sieve" quota_full_tempfail = yes service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0600 user = postfix } } service imap-login { service_count = 0 vsz_limit = 128 M } service imap { process_limit = 2048 } service lmtp { inet_listener lmtp { address = x.x.x.x 127.0.0.1 ::1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 1 service_count = 0 vsz_limit = 256 M } ssl = required ssl_ca = ..hidden ssl_cert = ..hiden ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldaps.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = " quota imap_quota antispam" plugin { antispam_backend = pipe antispam_pipe_program = /fbc/bin/mail/sa-learn-pipe.sh antispam_pipe_program_notspam_arg = --ham antispam_pipe_program_spam_arg = --spam antispam_spam = Junk antispam_trash = Trash } } protocol sieve { mail_debug = yes

1 0

Why does Dovecot authentication against Openldap fail when using TLS encryption?
by Dimitri KOPRIWA 29 Jun '17

29 Jun '17

Dear Mailing list, I have a Dovecot v2.2.9 server that authenticate against a Openldap server. I want to configure Dovecot to use TLS for LDAP authentication. I have tried to fetch/send emails using Thunderbird: - IMAP succeed to fetch mail - SMTP failed to send mail The Dovecot server produce the following log : Jun 29 08:44:00 mail postfix/submission/smtpd[634]: connect from virtual.domain.com[172.16.0.1] Jun 29 08:44:01 mail dovecot: auth: Debug: auth client connected (pid=0) Jun 29 08:44:02 mail dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=172.17.0.15#011rip=172.16.0.1#011secured#011resp=<hidden> Jun 29 08:44:02 mail dovecot: auth: Debug: ldap(me(a)domain.com,172.16.0.1): bind search: base=dc=mail,dc=domain,dc=com filter=(&(objectClass=CourierMailAccount)(mail=me(a)domain.com)) Jun 29 08:44:02 mail dovecot: auth: Debug: ldap(me(a)domain.com,172.16.0.1): no fields returned by the server Jun 29 08:44:02 mail dovecot: auth: Debug: ldap(me(a)domain.com,172.16.0.1): result: uid missing Jun 29 08:44:02 mail dovecot: auth: Debug: client passdb out: OK#0111#011user=me(a)domain.com Jun 29 08:44:04 mail postfix/submission/smtpd[661]: connect from mail.node.domain-ovh.consul[172.16.0.2] Jun 29 08:44:04 mail postfix/submission/smtpd[661]: lost connection after CONNECT from mail.node.domain-ovh.consul[172.16.0.2] Jun 29 08:44:04 mail postfix/submission/smtpd[661]: disconnect from mail.node.domain-ovh.consul[172.16.0.2] Jun 29 08:44:07 mail dovecot: auth: Debug: auth client connected (pid=662) Jun 29 08:44:07 mail dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.16.0.2, lip=172.17.0.15, TLS handshaking: Disconnected, session=<MGK6TRVTRACsEAAC> **Note that before I switch to use TLS**, the server was doing clear connection to Openldap and the **binding was working fine**. I have verified the ldap query using `ldapsearch` and it confirmed my binding must have worked: me@dev-01:[~]: ldapsearch -x -D "cn=readonly,dc=domain,dc=com" -W -H ldap://ldap.domain.com:389 -b "dc=mail,dc=domain,dc=com" -LLL "(&(objectClass=CourierMailAccount)(mail=me(a)domain.com))" -ZZ homeDirectory Enter LDAP Password: dn: mail=me(a)domain.com,dc=mailAccount,dc=domain.com ,dc=mail,dc=domain,dc=com homeDirectory: /var/mail I have the following `dovecot.cf`: login_greeting = server ready mail_uid = 5000 mail_gid = 5000 auth_mechanisms = plain login disable_plaintext_auth = yes ssl_ca = </etc/postfix/ssl/cacert.pem auth_debug_passwords = no auth_debug = yes auth_verbose = yes userdb { driver = ldap args = /etc/dovecot/conf.d/auth-ldap.conf.ext } passdb { driver = ldap args = /etc/dovecot/conf.d/auth-ldap.conf.ext } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } And this is the included `/etc/dovecot/conf.d/auth-ldap.conf.ext` file: # SSL/TLS uris = ldap://virtual.domain.com auth_bind = yes ldap_version = 3 dn = cn=readonly,dc=domain,dc=com dnpass = abc base = dc=mail,dc=domain,dc=com user_filter = (&(objectClass=CourierMailAccount)(mail=%u)) pass_filter = (&(objectClass=CourierMailAccount)(mail=%u)) user_attrs = uidNumber=5000,gidNumber=5000,homeDirectory=home,mailbox=mail=maildir:%$/Maildir:LAYOUT=fs default_pass_scheme = SSHA tls = yes tls_ca_cert_dir = /etc/postfix/ssl Why does Dovecot authentication against Openldap fail when I switch to TLS encryption? Hoping this mail will be read by somebody, Regards, Dimitri

1 0

Re: localhost logins
by Joseph Tam 28 Jun '17

28 Jun '17

> Jun 27 12:03:27 bubba dovecot: auth: > ldap(SomeUser(a)MyDomain.com,127.0.0.1): invalid credentials > > The only other thing I can think of - Postfix runs on this server and > uses Dovecot SASL. Is it possible the Dovecot auth log line is caused > by a Postfix connection attempt? That would have been my first guess. Why don't you actually try it out (i.e. login in to SMTP with bad credentials) and see if the mysterious log entry appears. # Create bogus SMTP auth string AUTH=`echo "\0user\0badpassword\c" | openssl enc -base64` # SMTP session commands echo "EHLO test.client.helo\nAUTH PLAIN $PW\nQUIT" >data # Use whichever command your Postfix supports "250-AUTH PLAIN" # - if you greet pause, you'll have to enter data manually netcat -C mailserver 25 <data openssl s_client -crlf -quiet -starttls smtp -connect mailserver:25 <data openssl s_client -crlf -quiet -starttls smtp -connect mailserver:587 <data openssl s_client -crlf -quiet -connect mailserver:465 <data Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: localhost logins
by Daniel Miller 27 Jun '17

27 Jun '17

On 6/27/2017 1:33 AM, Daniel Miller wrote: > On 6/27/2017 12:42 AM, Fabian Schmidt wrote: >> >> Am 26.06.17 schrieb Daniel Miller: >> >>> On 2017-06-23 15:09, Marcus Rueckert wrote: >>>> On Fri, 23 Jun 2017 11:38:28 -0700 >>>> Daniel Miller <dmiller(a)amfes.com> wrote: >>>> >>>>> While auditing my logs after an account was compromised, I see a >>>>> number of entries like: >>>>> >>>>> Jun 23 11:32:18 bubba dovecot: auth: >>>>> ldap("one-of-my-accounts",127.0.0.1): invalid credentials >>>> >>>> webmail? >> >> Nagios or someone else monitoring dovecot? >> > Not running such - and they wouldn't be hitting multiple accounts. > Now I'm more confused. I changed Dovecot to listen only on a specific IP address - and I still see localhost log lines: Jun 27 12:03:27 bubba dovecot: auth: ldap(SomeUser(a)MyDomain.com,127.0.0.1): invalid credentials The only other thing I can think of - Postfix runs on this server and uses Dovecot SASL. Is it possible the Dovecot auth log line is caused by a Postfix connection attempt? Daniel

1 0

localhost logins
by Daniel Miller 27 Jun '17

27 Jun '17

While auditing my logs after an account was compromised, I see a number of entries like: Jun 23 11:32:18 bubba dovecot: auth: ldap("one-of-my-accounts",127.0.0.1): invalid credentials I'm trying to figure out where this login attempt is coming from. I do run ASSP (an SMTP proxy) on this server, as well as Postfix - but I wouldn't think there'd be any communication with Dovecot for those? Postfix does use Dovecot SASL - but I see separate log entries for Postfix authentication failures. There are of course plenty of external IP's listed in Dovecot logs - I'm just asking for possible causes for the localhost entries. -- Daniel

3 4