- dovecot - dovecot.org

Re: Postfix: running a script on authentication failure
by Joseph Tam 27 Jun '23

27 Jun '23

On Thu, 22 Jun 2023, Michael Peddemors wrote: > * Use services like RATS-AUTH to block IPs that can safely be blocked as known hackers.. Cool. Are there other DNSRBLs (apart from bl.blocklist.de) that list BFD attack IPs? > * Use services like RATS-NULL (or SpamHaus DROP lists) right in the firewall level. There are SOME networks > that should simply be 'unplugged' Can't find it in https://spamrats.com/. Is it an DNSRBL or downloadable file? > * Turn off port 110 (well, all plain text authentication) 90% less email compromise reports when you do.. That will disable STARTTLS though. Even though it's not plaintext, maybe that is a good thing as it avoids MITM banner stripping attacks. Joseph Tam <jtam.home(a)gmail.com>

2 1

Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?
by David Mehler 24 Jun '23

24 Jun '23

Hello, I'm migrating to a new server. It's running Debian 11 currently though that's going 12 this weekend. Currently it uses Openssl v3.0.9, and dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user account information v10.6.14. My question is in regards password storage and scheme/encryption/salts. Currently they are stored in Mariadb password field with a type of varchar and a 255 character length, and are stored as SHA512-CRYPT. I'm wondering if I should keep this as is or when I migrate go to another scheme? I'm thinking argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, saltt? Discussion/opinions welcome. Thanks. Dave.

2 3

configuring Dovecot submission service
by Computerisms Corporation 24 Jun '23

24 Jun '23

Hi Dovecot Gurus, I have been playing around with the submission service. I have managed to get all the things working that I want working with two exceptions. I have not found (or possibly I have overlooked) solutions in the documentation or discussions on the 'net. First; I would like to be able to authenticate against my backend MTA using the user-supplied credentials. I have tried setting submission_relay_user as %u and submission_relay_password as %w, but these seem to be passed through as literal strings, and of course my backend MTA has no idea who %u is. I found a post from 2019 that indicates passing the submission_relay_user/password to the backend is not a supported function, but hoping that maybe that is outdated info. I also found: https://doc.dovecot.org/3.0/configuration_manual/authentication/proxies/ Which seems to indicate it could pass credentials to a non-Dovecot MTA backend, but I am not really clear from the docs on how to set that up, and I did not find any relevant examples to work from. Seems like it would be setting up a Director service, maybe? I have done that before and I do manage multiple email servers, but none of them is clustered or configured to be interoperable, so not sure if this is a viable approach. Second; I am wondering about the possibility of having multiple submission_relay_host entries. For example if I have dovecot submission services running on my standard port 587 and 465 connect to a relay on the same box through localhost, but could I have another submission service running on another port, say 5587, and relay all traffic received on that port through a completely different host? I am thinking I could set that up by running a separate instance of dovecot for just that service, but maybe there is a more suitable way? I don't have a solid use-case for this in mind at the moment, but given that I do manage multiple email servers, I am thinking that if this is possible it might provide some useful corner-case configurations down the road. Thank you for reading my post, any thoughts, information, or pointers to relevant documentation would be most appreciated. -- Bob Miller 867-334-7117 www.computerisms.ca

2 3

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

4 4

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

1 0

el9 rpms
by Marc 21 Jun '23

21 Jun '23

Is there a specific reason why there are (still) no el9 packages? https://repo.dovecot.org/ce-2.3.17/centos/ https://repo.dovecot.org/ce-2.3-latest/rhel/

4 7

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot reposting inactivity as auth failed
by pedro＠netsecpt.pt 21 Jun '23

21 Jun '23

Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Dovecot Version : 2.3.19.1 (9b53102964) Log imap line with issues : dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<myemail@mydomain>, method=PLAIN, rip=xxx.xxx.xx.xx, lip=xxx.xxx.xxx.xxx, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<some_hash> Thank you

3 6

Submission behaviour
by André Rodier 20 Jun '23

20 Jun '23

Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password. Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server. Here an example, of nftable ruleset, for dovecot imap(s): ------------------------------------------------------------------- table inet filter { set banned_imap_ipv4 { type ipv4_addr flags dynamic,timeout timeout 1d } set banned_imap_ipv6 { type ipv6_addr size 65535 flags dynamic,timeout timeout 1d } chain input { # Limit new imap connections ala fail2ban meta nfproto ipv4 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } meta nfproto ipv6 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr } # Reject the traffic explicitly ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited tcp dport { imap, imaps } ct state new counter accept \ comment "Accept imap/imaps connections" } } ------------------------------------------------------------------- Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android. There is also a way to save the rules before restarting the firewall, which works very well as well: ------------------------------------------------------------------- # nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } } ------------------------------------------------------------------- Now, the question I have is this. I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP. However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587) Thanks for your insights.

1 0

Re: Dovecot reposting inactivity as auth failed
by Joseph Tam 20 Jun '23

20 Jun '23

From: pedro(a)netsecpt.pt > Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . > Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Putting aside the semantics that not supplying credentials before the timeout *is* an auth failure, I would think the best way to handle this is to change the pattern fail2ban triggers to be more specific about what it considers an auth failure. If this is a typical log entry you want to avoid an automatic ban dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user= ... I would modify /etc/fail2ban/filter.d/dovecot.conf to limit it to 0-99sec like so failregex = ...( in \d{1,2} secs)... Some BFD attempts will leak through but it avoids triggering on any inactivity >99s. Joseph Tam <jtam.home(a)gmail.com>

1 0