- dovecot - dovecot.org

[Dovecot] v2.2.13.rc1 vs. Pigeonhole
by Tamsy 12 May '14

12 May '14

Server: Ubuntu 10.04 LTS 32bit There seems to be an incompatibility when compiling Pigeonhole against Dovecot v2.2.13.rc1. # make check with Pigeonhole throws up the following error message: <snip> Test case: ./tests/extensions/editheader/addheader.svtest: 1: Test 'Addheader - first' SUCCEEDED 2: Test 'Addheader - last' SUCCEEDED 3: Test 'Addheader - framed' SUCCEEDED 4: Test 'Addheader - folded' SUCCEEDED 5: Test 'Addheader - newlines' FAILED: wrong first header content in redirected mail 6: Test 'Addheader - implicit keep' SUCCEEDED 7: Test 'Addheader - UTF 8' SUCCEEDED 8: Test 'Addheader - devious characters' SUCCEEDED FAIL: 1 of 8 tests failed. I tried this with the latest Pigeonhole from Mercurial: - dovecot-2-2-pigeonhole-3b6917a4807c and also with the older: - dovecot-2-2-pigeonhole-e111a2393a92 Both versions are quitting during "make check" with the same error when compiling against dovecot-2.2.13.rc1. Compiling those versions against dovecot-2.2.12 is going without errors though. Cheers, Tamsy

3 4

[Dovecot] message-decoder bug for attachments with charset=binary attribute in content-type?
by Robert Wolf 12 May '14

12 May '14

Hello, I have configure dovecot with solr and I wanted to let solr index content of attachments. For testing I have used biabam command line tool to generate emails with attachments. I have found that dovecot with fts_decoder incorrectly decodes these attachments from biabam and therefore pdftotext has reported corrupted PDF. The problem is that biabam generates header with charset=binary and dovecot message decoder tries to process it as UTF8 or non-UTF8 data. ============================================================ --biabam.ZxWVLybiabam.ZxWVLy Content-Type: application/pdf; charset=binary Content-Disposition: attachment; filename="bacula-jobs.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjQKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVy IC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nF2PT0+EMBDF7/0U7yYYWdqFXdbe 1vgnMXpQezMeClSoQNltweh+egvLyczhN3kz703mCLpioFMtLDoSv2aoHKGo ..... ============================================================ This PDF begins orginal with ============================================================ 0000000: 2550 4446 2d31 2e34 0a25 c7ec 8fa2 0a35 %PDF-1.4.%.....5 0000010: 2030 206f 626a 0a3c 3c2f 4c65 6e67 7468 0 obj.<</Length 0000020: 2036 2030 2052 2f46 696c 7465 7220 2f46 6 0 R/Filter /F 0000030: 6c61 7465 4465 636f 6465 3e3e 0a73 7472 lateDecode>>.str ============================================================ But the dovecot pass following data to fts_decoder script: ============================================================ 0000000: 2550 4446 2d31 2e34 0a25 c3a4 c3bc c3b6 %PDF-1.4.%...... 0000010: c39f 0a32 2030 206f 626a 0a3c 3c2f 4c65 ...2 0 obj.<</Le 0000020: 6e67 7468 2033 2030 2052 2f46 696c 7465 ngth 3 0 R/Filte 0000030: 722f 466c 6174 6544 6563 6f64 653e 3e0a r/FlateDecode>>. ============================================================ As you can see binary data are mangled. Alpine and Thunderbird do not write charset=binary to content-type header and searching works perfect. I have searched in source code and I have found one place. If I replace the following code in file dovecot-2.1.7/src/lib-mail/message-decoder.c on line 241 with new one, the dovecots message decoder decodes message correctly and pdftotext can convert attached PDF. Original code: ============================================================ 241: ctx->binary_input = ctx->content_charset == NULL && 242: (ctx->flags & MESSAGE_DECODER_FLAG_RETURN_BINARY) != 0 && 243: (part->flags & (MESSAGE_PART_FLAG_TEXT | 244: MESSAGE_PART_FLAG_MESSAGE_RFC822)) == 0; ============================================================ My update: ============================================================ 241 ctx->binary_input = ((ctx->content_charset != NULL) && (strcasecmp(ctx->content_charset, "binary") == 0)) || (ctx->content_charset == NULL && 242 (ctx->flags & MESSAGE_DECODER_FLAG_RETURN_BINARY) != 0 && 243 (part->flags & (MESSAGE_PART_FLAG_TEXT | 244 MESSAGE_PART_FLAG_MESSAGE_RFC822)) == 0); ============================================================ This will set ctx->binary_input for the attachment with charset set to "binary". I don't know if this is correct update, but the searching works with this update for biabam binary attachments too. Could you please verify this problem and maybe update the code? Thank you very much. # dovecot --version 2.1.7 Config: plugin { fts = solr fts_solr = url=http://localhost:8080/solr/ fts_decoder = decode2text } service decode2text { executable = script /etc/dovecot/scripts/decode2text.sh user = dovecot unix_listener decode2text { mode = 0666 } } Regards, Robert Wolf.

1 0

[Dovecot] questions about process_limit
by Andreas Meyer 12 May '14

12 May '14

Hello all! # dovecot --version 2.1.17 Sometimes I have this in the logfile: May 11 16:55:52 master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped May 11 17:35:03 master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped May 11 17:36:27 master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped I then put this in the dovecot.conf service imap-login { service_count = 1 process_min_avail = 50 #process_limit = $default_process_limit process_limit = 10000 vsz_limit = 64M } and get this: May 11 18:19:36 master: Info: Dovecot v2.1.17 starting up (core dumps disabled) May 11 18:19:36 config: Warning: service auth { client_limit=1000 } is lower than required under max. load (10300) May 11 18:19:36 config: Warning: service anvil { client_limit=1000 } is lower than required under max. load (10203) Puting this in: service auth { client_limit = 10300 unix_listener auth-userdb { mode = 0666 user = vmail group = vmail } } service anvil { client_limit = 10300 } I get this: May 11 18:27:37 delta.bitcorner.eu dovecot[3989]: Warning: fd limit (ulimit -n) is lower than required under max. load (1024 < 10300), because of service auth { client_limit } I have also seen this today: May 11 13:14:05 log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) May 11 13:14:05 auth: Error: read(anvil-auth-penalty) failed: EOF May 11 13:14:05 auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied What is the best way to avoid this process_limit errors and configure dovecot the best way? Greetings Andreas

3 2

[Dovecot] Segfault with passwd as a second userdb at auth_fields_rollback
by Jan Kończak 11 May '14

11 May '14

Hello, I've been trying to set up dovecot to support passwd-file + passwd/PAM auth. I made an unusual config (passwd-file as userdb failed to work for me), which uses static as userdb: =============== passdb { driver = passwd-file args = username_format=%u scheme=CRYPT /etc/dovecot/users } userdb { driver = static default_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n } passdb { driver = pam } userdb { driver = passwd } =============== While passwd-file+static worked well, passwd/PAM caused trouble: $ doveadm user xxx doveadm(root): Error: userdb lookup(xxx): Disconnected unexpectedly field value If passwd-file had the user, check went fine; otherwise it segfaulted. The crash has been accompanied by a syslog message: kernel: auth[9788]: segfault at 18 ip 0000000000416391 sp 00007fffd11a3d90 error 4 in auth[400000+44000] Translating address lead me to: 0000000000416390 <auth_fields_rollback>: 416390: 53 push %rbx 416391: 48 83 7f 18 00 cmpq $0x0,0x18(%rdi) I was using packages from http://packages.atrpms.net/dist/el6/dovecot/ To be precise, dovecot-2.2.10-1_14.el6.x86_64.rpm I tampered with the src.rpm, upgraded spec&sources to match 2.2.12. It didn't help, so I tries to "workaround" this. The bug has gone when in src/auth/auth-fields.c:210 I added check if the field ptr is not null. As it's a userdb query, it seems that for some reason (static?) in src/auth/auth-request.c:1058 the function auth_fields_rollback is called with null request->userdb_reply Now it works fine: $ doveadm user xxx field value uid 1000 gid 100 home /home/xxx mail maildir:~/.maildir system_groups_user xxx $ doveadm user jkonczak@ast... field value uid 103 gid 103 home /var/spool/mail/ast.../jkonczak mail maildir:~/.maildir So now virtual users get vmail uid/gid, system users get their uid/gid, home is fine etc. Below I attach the patch + full config. Regards, Jan Kończak =============================================== $ cat SOURCES/dovecot-2.2.12-auth_fields_rollback-nullptr_check.patch --- src/auth/auth-fields.c.orig 2014-05-11 16:17:49.755258666 +0200 +++ src/auth/auth-fields.c 2014-05-11 16:18:24.704946586 +0200 @@ -207,6 +207,7 @@ void auth_fields_rollback(struct auth_fields *fields) { + if (fields==NULL) return; if (array_is_created(&fields->snapshot_fields)) { array_clear(&fields->fields); array_append_array(&fields->fields, &fields->snapshot_fields); =============================================== $ dovecot --version 2.2.12 $ doveconf # passdb/userdb/auth related passdb { args = username_format=%u scheme=CRYPT /etc/dovecot/users default_fields = deny = no driver = passwd-file master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } passdb { args = default_fields = deny = no driver = pam master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } userdb { args = default_fields = uid=vmail gid=vmail home=/var/spool/mail/%d/%n driver = static override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } userdb { args = default_fields = driver = passwd override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } ===============================================

2 1

[Dovecot] "doveadm penalty -a" doesn't work?
by Peer Heinlein 11 May '14

11 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We're running multiple instances on the same server. While doveadm penalty works: root@host:/etc/dovecot# doveadm penalty IP penalty last_penalty last_update 93.180.xxx.xxx 4 2014-05-10 12:21:08 12:21:08 80.153.xxx.xxx 0 2014-05-10 12:21:12 12:21:12 a seperate anvil-Socket doesn't work at all: root@host:/etc/dovecot# doveadm penalty -a /var/run/dovecot-example/anvil doveadm penalty [-a <anvil socket path>] [<ip/bits>] It just shows up the help message. (Dovecot 2.2.12) Peer - -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTbf41AAoJEAOLLpq5E82H/h4H/2VpFfrqG+dcW73dS8CAWXVM thWcj5/GKUDaE/MYKsATDmNenlPuKIHsC8+hM7pyB3kfA0d7EDP/aNcaOWdw16XE fq7PSoLWiPJcsTG6ArzyuJMYiCwb2TuFIimFjjlZWVqnB+iAVv0y7ESJ9De/dmzM eE3ct/JmuY+0MrRAKSNdDX/Dbaakh03/JQ3/GvAwYeTFgviCfa3D5hsYCfhDZbPC 2vE3A9D46SqhmrediuWdtnj6rAhYwfjS+77jXaK6NyYru0WtYf9ozgtt5pbb89Hd EKzdNyKdKsZEnQ1ubv7cj5671OwL1ikp/d8tJr3/l4tgRHWf2+BmuGJIoo8AFwE= =2gZD -----END PGP SIGNATURE-----

2 1

[Dovecot] ECDSA certificate support
by SIW 11 May '14

11 May '14

Does the latest version of Dovecot support ECDSA certificates? I had a look in: http://wiki2.dovecot.org/SSL but it didn't answer my question. Can someone please help or point me in the right direction? I'd also like to know if I can run an RSA cert AND an ECDSA certificate at the same time in Dovecot (like you can in Postfix). Many thanks.

1 0

[Dovecot] LDA can't read dovecot.conf
by Hit4er 11 May '14

11 May '14

Hi, i have a problem with lda with this error what i doing wrong? -- View this message in context: http://dovecot.2317879.n4.nabble.com/LDA-can-t-read-dovecot-conf-tp47853.ht… Sent from the Dovecot mailing list archive at Nabble.com.

4 5

[Dovecot] dovecot 2.2.9 - ssl_cert and ssl_key ignored
by Alexandru Bostina 11 May '14

11 May '14

Hello, It seems that Dovecot ignores the new /ssl_cert and ssl_key /settings. Using them in the dovecot configuration results in the error: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: ANY PRIVATE KEY] Using the old /ssl_//cert//_file/ and /ssl_key_file/ results in their being obsolete warning but no fatal error.

3 4

[Dovecot] Only part of sieve script works
by Sebastian Schlingmann 10 May '14

10 May '14

Hi, I am using Dovecot 2.2.11 with Pigeonhole on Arch Linux. I have a partly working sieve script (pasted to the end of this mail) which sorts mail into various imap folders. The first, third and fourth if blocks work just fine. The second and fifth block do not sort any mails. However, if I apply the script with sieve-test to mails the second and fifth block seem to work. How is the manual check with sieve-test different from the sieve filtering during mail delivery? I am thankful for any hints. Sebastian this is the sieve script I am talking about require "fileinto"; # Musik wegsortieren if anyof ( header :comparator "i;ascii-casemap" :contains "Subject" "Mixing.DJ", header :comparator "i;ascii-casemap" :contains "Subject" "John B", header :comparator "i;ascii-casemap" :contains "Subject" "FLOSS Weekly", header :comparator "i;ascii-casemap" :contains "Subject" "BrainStuff", header :comparator "i;ascii-casemap" :contains "Subject" "Nerdy Show", header :comparator "i;ascii-casemap" :contains "Subject" ["My Brother", " My Brother And Me"], header :comparator "i;ascii-casemap" :contains "Subject" "MoJoMenace", header :comparator "i;ascii-casemap" :contains "Subject" "GWJ Conference Call", header :comparator "i;ascii-casemap" :contains "Subject" "Welcome to Night Vale", header :comparator "i;ascii-casemap" :contains "Subject" "International Waters" ) { fileinto "Feeds.music"; stop; } # Youtube wegsortieren if address :all :comparator "i;ascii-casemap" :contains "From" "noreply(a)youtube.com" { fileinto "Feeds.Youtube"; stop; } # Awesomer wegsortieren if header :comparator "i;octet" :contains "Subject" "[The Awesomer]" { fileinto "Feeds.Awesomer"; stop; } # Feeds sortieren if address :all :comparator "i;octet" :contains "From" "sebi+feedmailer(a)mighty.selfhost.bz" { fileinto "Feeds"; stop; } # AIStA wegsortieren if header :comparator "i;ascii-casemap" :contains "Received" "webmail.awista.net" { fileinto "AIStA"; stop; }

2 1

[Dovecot] Denial of Service attacks against Dovecot v1.1+
by Timo Sirainen 10 May '14

10 May '14

There's an upper limit to how many IMAP/POP3 connections can exist that haven't logged in (and separate limits for post-login). Normally when this limit is reached, the oldest connection gets disconnected. There is of course some potential to try to DoS Dovecot by doing a lot of IMAP/POP3 connections, but because the oldest connection always gets destroyed this requires quite a lot of activity from the attacker. This "destroy oldest connection" however hasn't been working in v1.1+ releases for connections that have started SSL/TLS handshake, but haven't finished it. So an attacker could just do a bunch of TCP connections to port 993 and leave them hanging around and Dovecot would pretty quickly reach the upper limit without being able to disconnect any of the oldest connections. Here are patches to fix this: http://hg.dovecot.org/dovecot-2.2/rev/41622541a7a3 http://hg.dovecot.org/dovecot-2.1/rev/b7ac23b4d339 http://hg.dovecot.org/dovecot-2.0/rev/48f90e7e92dc http://hg.dovecot.org/dovecot-1.2/rev/8ba4253adc9b http://hg.dovecot.org/dovecot-1.1/rev/fe0e6550585c The fix will be in v2.2.13. Maybe also in v2.1.18 if I decide to release it. For older releases you need to patch it yourself. For people who are using dovecot-ee releases the fix is also in v2.2.12.12 and v2.1.7.7 releases.

3 2