- dovecot - dovecot.org

CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3223 (Bug ID) Vulnerability type: CWE-617 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notification: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11499 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Workaround: Authentication crash can be avoided if authentication is done without TLS. Solution: Operators should upgrade to a fixed version.

1 0

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting.
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3212 (Bug ID) Vulnerability type: CWE-476 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Researcher credits: Marcelo Coelho Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notificatio: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11494 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s). Workaround: There is no available workaround for this issue. Solution: Operators should upgrade to a fixed version.

1 0

Re: Sis to deduplicate attachments does not work?
by Daniel Miller 29 Apr '19

29 Apr '19

On April 23, 2019 10:54:38 PM luckydog xf <luckydogxf(a)gmail.com> wrote: > Is it worthwile to use dbox? seeing from > http://www.linuxmail.info/mbox-maildir-mail-storage-formats/ it may cause > file lock and easy to corrupt. As with everything - it depends. You're asking me so these are *my* opinions - and I do not claim to be anything more than a hobbyist/tinkerer when the comes to this. mbox has potential use for long term read-only archives - I see no reason to use it for live mailboxes. maildir is undoubtedly the least susceptible to corruption. It's also the slowest format for reading. How slow is "slow" depends on your hardware - it may be imperceptible with enough RAM and SSD's - or it may result in user complaints with large mailboxes. dbox is Dovecot's preferred format. I know Timo has put a lot of effort into it. sdbox is similar to maildir in that each mail is a separate file. mdbox significantly reduces the number of files which can make file-based backups faster. Both dbox formats are dependent on their index files. If you've got good hardware, including a proper UPS, I'd recommend dbox (my server is presently using sdbox). With large mailboxes and file-based backups you'll benefit from mdbox. When reliability is the #1 concern above anything else - use maildir. Depending on your use SIS can have significant impact on storage requirements - but storage these days is relatively cheap. I haven't seen much feedback from users actively using SIS - I'd love to hear from high traffic sites with SIS experience to know if the corruption issues have been resolved. In my case there was at least a 30% reduction in space but I had too many errors - admittedly it's been a couple years since I last tried it. -- Daniel

3 3

Using lmtp to authenticate email users
by Patrick Mahan 29 Apr '19

29 Apr '19

FreeBSD 11.2 Postfix 3.3.2 Dovecot 2.3.4 I am trying to use dovecot lmtp with postfix to verify authentication of incoming email and to avoid being a spam relay (an issue I was having using sendmail as my MTA). I am getting the following log message in /var/log/maillog: Mar 30 20:31:38 ns postfix/smtpd[40373]: NOQUEUE: reject: RCPT from mail-eopbgr750091.outbound.protection.outlook.com[40.107.75.91]: 450 4.1.1 < mahan(a)mahan.org>: Recipient address rejected: unverified address: host ns.mahan.org[private/dovecot-lmtp] said: 550 5.1.1 <mahan(a)mahan.org> User doesn't exist: mahan(a)mahan.org (in reply to RCPT TO command); from=< pmahan(a)silver-peak.com> to=<mahan(a)mahan.org> proto=ESMTP helo=< NAM02-BL2-obe.outbound.protection.outlook.com> 'mahan' does exist on ns.mahan.org. So I am confused to why lmtp is failing to find this username. Thanks, Patrick

4 5

used Lazyexpunge
by lty 28 Apr '19

28 Apr '19

I used Lazyexpunge. I tried to create .DELETED without any hints and see that the creation was successful. I want to prevent users from creating .DELETED, what should I do? My settings > plugin { > lazy_expunge = .DELETED/ > } > # > > namespace { > prefix = .DELETED/ > hidden = yes > list = no > separator = / > location = maildir:/var/vmail/backup/expunged/%d/%n > }

2 1

Auto rebuilding of Solr indexes on settings change?
by Peter Mogensen 25 Apr '19

25 Apr '19

Hi, Looking at the source, it doesn't seem like fts-solr checks for settings changes using fts_index_have_compatible_settings() like fts-lucene does. Is there any special reason for why fts-solr shouldn't also rebuild indexes if settings has changed? /Peter

2 1

msg header has bad magic value
by 김태용 25 Apr '19

25 Apr '19

There was an error saving the message. 'Error: Corrupted dbox file /storage/m.1 (around offset = 21589): msg header has bad magic value' Why do I get an error? How can I fix it?

1 0

haproxy + submission services -> postfix failure
by Chris Thomas 24 Apr '19

24 Apr '19

Hi, I have a nginx server which is using the proxy protocol to forward tcp connections to dovecot. Dovecot is configured to be a submission service for email to be sent. Then postfix should send the email itself which is also using the ha proxy protocol. There are a few moving parts in this problem so I'm not sure where the problem is. But I want to ask if somebody can validate my dovecot configuration somehow so I can start to tick off some things from the list. Sending email fails, seems to get to postfix, then die Receiving emails succeeds and I don't have any problem to pick them up. I've figured out some stuff, like lmtp shouldn't use haproxy when talking between postfix -> dovecot for receiving emails. If I enable the protocol on lmtp, I can't receive any emails at all. In order to get postfix to accept emails, I enabled haproxy protocol and enabled postscreen and then postfix could access the source ip and stop my server from being an open relay. I've got tls certificates installed on dovecot and postfix, all created by letsencrypt and I don't appear to have any problems with them. I will try to give as much information about the config as I can, I'm not sure what other parts are good to have, but let me know if you are missing something or want to check a value. >> 10-master.conf: service submission-login { inet_listener submission { port = 587 haproxy = yes } } service lmtp { inet_listener lmtp { port = 24 haproxy = no } } >> 20-submission.conf submission_relay_host = postfix.mail-server submission_relay_port = 25 submission_relay_ssl = starttls submission_relay_ssl_verify = yes Then because it might help to give the other side of the connection configuration for postfix, here is the relevant information: >> master.cf: smtp inet n - - - 1 postscreen smtpd pass - - - - - smtpd >> main.cf postscreen_upstream_proxy_protocol = haproxy postscreen_upstream_proxy_timeout = 10s That's it. I don't know what other information could be useful. There are some logs, they are like this (I've got logging turned on for pretty much every option I have: Dovecot logs: Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Effective uid=8, gid=8, home=/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: maildir++: root=/mail/__DOMAIN_COM__/__USER__, index=, indexpvt=, control=, inbox=/mail/__DOMAIN_COM__/__USER__, alt= Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Looking up IP address Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: DNS lookup successful; got 1 IPs Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connecting to 10.104.211.161:25 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Received greeting from server: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection failed: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Error: Failed to establish relay connection: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Disconnected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Info: Disconnect from __IP_ADDR_1__: Failed to establish relay connection in=0 out=22 (state=GREETING) Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Disconnected: Failed to establish relay connection Postfix Logs: postfix/postscreen[525]: warning: haproxy read: time limit exceeded If anybody could help out, I'd be grateful because I just can't see what the problem is. Chris

2 1

lmtp_save_to_detail_mailbox override
by Andreas Thienemann 24 Apr '19

24 Apr '19

Hi, I have a dovecot 2.3.2.1 instance running here that is getting userdb and passdb data from a SQL database. This was a cyrus server migrated over and all users are happy. All users except one: Said user asked if it would be possible to disable subaddressing (localuser+folder(a)example.com) again. The setting controlling that is AFAIK the lmtp_save_to_detail_mailbox item. My idea was to override that setting for the specific user. I changed the user_query to return no for the user in question and all seems well: # doveadm user test field value user test(a)example.com uid vmail gid vmail home /var/lib/imap/example.com/test mail mdbox:/var/spool/imap/user/example.com/test lmtp_save_to_detail_mailbox no # Looks good, doesn't work though. Mail is still delivered to the +folder. Is this per user setting not taken into account? I could probably provide the user in question with a sieve script that files everything into the INBOX again but I wonder if there's a better way? cheers, Andreas

3 3

pigeonhole tests crashing in deleteheader.svtest
by Michal Hlavinka 24 Apr '19

24 Apr '19

Hi, when trying to build dovecot 2.3.5.1 pigeonhole testsuite crashes in Test case: ./tests/extensions/editheader/deleteheader.svtest: 1: Test 'Deleteheader - nonexistent' SUCCEEDED 2: Test 'Deleteheader - nonexistent (match)' SUCCEEDED 3: Test 'Deleteheader - one' SUCCEEDED 4: Test 'Deleteheader - two (first)' SUCCEEDED 5: Test 'Deleteheader - two (last)' SUCCEEDED 6: Test 'Deleteheader - :index' SUCCEEDED 7: Test 'Deleteheader - :index :last' SUCCEEDED 8: Test 'Deleteheader - implicit keep' SUCCEEDED make: *** [Makefile:1190: tests/extensions/editheader/deleteheader.svtest] Segmentation fault (core dumped) Let me know if you need more debug information. Cheers Michal Hlavinka #0 0x00007f9924faea8a in __strlen_sse2 () from /lib64/libc.so.6 #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 #2 0x000055f7330916b3 in testsuite_message_set_data (mail=0x55f73486f848) at testsuite-message.c:96 #3 0x000055f7330918b9 in testsuite_message_set_file (renv=renv@entry=0x55f734856ac0, file_path=<optimized out>) at testsuite-message.c:139 #4 0x000055f7330931cc in testsuite_smtp_get (renv=renv@entry=0x55f734856ac0, index=<optimized out>) at testsuite-smtp.c:171 #5 0x000055f73309566c in cmd_test_message_smtp_operation_execute (renv=0x55f734856ac0, address=<optimized out>) at cmd-test-message.c:404 #6 0x00007f992543f371 in sieve_interpreter_operation_execute (interp=0x55f734856a68) at sieve-interpreter.c:911 #7 sieve_interpreter_continue (interp=0x55f734856a68, interrupted=0x0) at sieve-interpreter.c:949 #8 0x00007f992543f5d1 in sieve_interpreter_run (interp=0x55f734856a68, result=<optimized out>) at sieve-interpreter.c:999 #9 0x000055f73308f670 in testsuite_run (msgdata=<optimized out>, ehandler=<optimized out>, senv=0x7ffd30eacfa0, sbin=<optimized out>) at testsuite.c:73 #10 main (argc=<optimized out>, argv=<optimized out>) at testsuite.c:203 (gdb) up #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 632 dsize = strlen(src->domain) + 1; (gdb) p *src $4 = {localpart = 0x55f73480cdc8 "/tmp/dsieve-testsuite.1553794316.30960/smtp/0.eml", domain = 0x1 <error: Cannot access memory at address 0x1>}

3 5

Sis to deduplicate attachments does not work?
by luckydog xf 23 Apr '19

23 Apr '19

Hi, I use sis to deduplicate attachments, here is my `doveconf -n` ------------ auth_cache_size = 10 M auth_failure_delay = 5 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_username_from_cert = yes auth_username_format = %Ln default_vsz_limit = 512 M lmtp_rcpt_check_quota = yes mail_attachment_detection_options = add-flags-on-save mail_attachment_dir = /var/mail/mail_attachment/ mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/%n/Maildir mail_plugins = quota fts fts_solr mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_solr = break-imap-search url=http://localhost:8983/solr/dovecot/ quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 5M quota_over_flag_lazy_check = yes quota_over_flag_value = TRUE quota_rule = *:storage=100M quota_warning = storage=65%% quota-warning 65 %u quota_warning2 = storage=60%% quota-warning 60 %u sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp sieve service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0640 user = postfix } unix_listener auth-userdb { mode = 0777 user = $default_internal_user } user = $default_internal_user } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 128 M } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 0 } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/var/mail/%u driver = ldap } protocol !indexer-worker { mail_vsize_bg_after_count = 0 } protocol lda { mail_plugins = quota fts fts_solr sieve } protocol imap { mail_max_userip_connections = 5 mail_plugins = quota fts fts_solr imap_quota } protocol lmtp { mail_plugins = quota fts fts_solr } --------- I try to send an email and then forward this email to another recipient. No attachment is generated in `mail_attachment_dir`. Anything wrong ?

2 1

making selected accounts read-only
by Wojciech Puchar 23 Apr '19

23 Apr '19

how to make selected few accounts readonly by pop3/imap?

3 2

SolrCore 'dovecot' is not available due to init failure: fieldType 'text_general' not found in the schema
by luckydog xf 23 Apr '19

23 Apr '19

Hello, it seems an mismatch of schema file provided by dovecot-2.3.5.2 [root@mail conf]# pwd /var/solr/data/dovecot/conf # Below solrconfig.xml is from Solr-8.0.0. [root@mail conf]# grep text_general solrconfig.xml <str name="queryAnalyzerFieldType">text_general</str> field types. Text content will be indexed as "text_general" as <str name="fieldType">text_general</str> # schema is from /usr/share/doc/dovecot/solr-schema.xml dovecot-2.3.5.2 and the latest solr-8.0.0. It seems XMLs do not match each other. How can I fix this problem？ Thanks.

3 5

mbsync updating new emails but dovecot not reading them ? [2.3.3]
by Kunal A. 21 Apr '19

21 Apr '19

Hi, Once again sincere apologies for emailing here. My dovecot isn't reading the newly updated e-mails from the mbsync. I have tried running doveadm -D -v force-resync -u email1(a)example.com "Inbox/Public/Other Users/user1(a)example.com" Plese help if possible. Highly appreciate if someone could help here... Below is the debug log :- Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(email1(a)example.com)<20402><>: Debug: auth USER input: email1(a)example.com uid=5000 gid=5000 home=/var/mail/vhosts/ example.com/email1 doveadm(email1(a)example.com): Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/example.com/email1 doveadm(email1(a)example.com): Debug: quota: No quota setting - plugin disabled doveadm(email1(a)example.com): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(email1(a)example.com): Debug: maildir++: root=/var/mail/vhosts/ example.com/email1/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/example.com/email1/Maildir, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 1 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs doveadm(email1(a)example.com): Debug: fs: root=/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 0 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(email1(a)example.com): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl vfile: file /var/mail/vhosts/ example.com/email1/Maildir/dovecot-acl not found Doveconf output :- # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # OS: Linux 5.0.7-200.fc29.x86_64 x86_64 Fedora release 29 (Twenty Nine) # Hostname: machine auth_mechanisms = plain login mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = acl quota mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace { list = children location = maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/mail/vhosts/example.com/Sharedbox } postmaster_address = postmaster at example.com protocols = imap pop3 service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } protocol lmtp { mail_plugins = quota acl sieve quota } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = acl quota imap_acl quota acl imap_quota }

1 1

FTS delays
by Joan Moreau 21 Apr '19

21 Apr '19

Hi When I do a FTS search (using Xapian plugin) in the BODY part, the plugins returns the matching IDs within few milliseconds (as seen in the log). However, roundcube (connected on dovecot) takes ages to show (headers only vie IMAP) the few results (I tested with a matching requests of 9 emails) What could be the root cause ? Thank you

6 24

maildirlock fails
by Martynas Bendorius 21 Apr '19

21 Apr '19

Hello, Maildirlock seems to panic on locking: [root@centos7 home]# /usr/libexec/dovecot/maildirlock "/home/user/imap/domain.com/email/Maildir" 10 Panic: BUG: No IOs or timeouts set. Not waiting for infinity. Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd90ee) [0x7f5bf02f10ee] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9131) [0x7f5bf02f1131] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f5bf0256efd] -> /usr/lib/dovecot/libdovecot.so.0(+0xf078c) [0x7f5bf030878c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x36) [0x7f5bf030b1f6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x56) [0x7f5bf03099c6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f5bf0309be8] -> /usr/libexec/dovecot/maildirlock(main+0x24a) [0x558ae0e032ca] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f5befe6d3d5] -> /usr/libexec/dovecot/maildirlock(+0x13a2) [0x558ae0e033a2] Is this a known issue? Thank you! -- Best regards, Martynas Bendorius

2 3

stats-writer error is back
by unknown＠example.com 20 Apr '19

20 Apr '19

Afer a reboot (and installation of postfix-3.4.5) I am getting the stat-writer permission denied error again. from doveconf -n service stats { unix_listener stats-reader { user = dovecot } unix_listener stats-writer { user = dovecot } } # ls -ls /var/run/dovecot/stats-writer 0 srw-rw---- 1 dovecot dovecot 0 Apr 20 04:34 /var/run/dovecot/stats-writer Apr 20 04:45:00 mail postfix/pipe[80136]: 44mTxm3Mblzc3Td: to=<munged>, relay=dovecot, delay=0.06, delays=0.02/0.02/0/0.02, dsn=2.0.0, status=sent (delivered via dovecot service (lda(,munged,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permiss)) -- W is for WINNIE embedded in ice X is for XERXES devoured by mice

3 6

Extended logging / moved mails jumping back
by Martin Müller 20 Apr '19

20 Apr '19

Hi! About 4-6 MUA Thunderbird 60.6.1 are going to connect with dovecot 2.2.13/IMAP (debian 8) and are using the same user/password. This setup works for years flawless (updated clients and serversoftware). Since a few weeks there is one major trouble: I one of the client moves a mail from the inbox to a another IMAP-Folder, most of the moved mail are moved for the moment. But an unstable period later, the mails are moved back to the inbox. In rarely cases, the moved mail is copied (one in the inbox, one in the destinationfolder). Now I have to check, if this a Thunderbird-Issue or is this a dovecot-issue. For that reason, I will activate the extended logging of dovecot. ### ### ### ### dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-6-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login debug_log_path = /var/log/mail.dovecot-debug disable_plaintext_auth = no info_log_path = /var/log/mail.dovecot-info listen = *,[::] log_path = /var/log/mail.dovecot-error log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)monarch.products4more.at } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)monarch.products4more.at } ### ### ### ### ### ### ### ### It works: dovecot logs to three differnt logfiles /var/log/mail.dovecot-* It doesnt work: plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } I cant see such events in the logfiles. Which switch is to turn on to log all events? Or do anyone know the reason for the annoying "copy/move-the-mail-back"-issue? Thank you in advance for all inputs. regards, martin

4 5

[Dovecot] Dovecot LDA/LMTP vs postfix virtual delivery agent and the x-original-to header
by Charles Marcus 19 Apr '19

19 Apr '19

On 2012-04-05 4:18 AM, Thomas Leuxner <tlx(a)leuxner.net> wrote: > Also with 2.x you may want to use LMTP rather than the LDA Piping. > > http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I am preparing to convert my main client's postfix_courier-imap setup to dovecot 2.1, which currently just uses the postfix virtual delivery agent... Does anyone know if the use of LMTP (or even the dovecot LDA) still loses the x-original-to header that the postfix vda adds and that I rely heavily on (since I use a lot of aliases), and if it does, is there any solution to get the original recipient added back in before final delivery? Everything I'm reading says that LMTP is better, but I really do need this header (or one like it) to be there so I know who the original recipient was (for filtering and other purposes). Thanks, -- Best regards, Charles

8 16

OAuth Passdb Grant
by Tom 19 Apr '19

19 Apr '19

I'm trying to implement the password grant flow, as specified at https://wiki2.dovecot.org/PasswordDatabase/oauth2, but am getting an error message. Can you please help? auth: Fatal: oauth2 /etc/dovecot/dovecot-oauth2.token.conf.ext: Error in configuration file /etc/dovecot/dovecot-oauth2.token.conf.ext line 1: Unknown setting: grant_url $ dovecot -n # 2.3.5.2 (38c8f1daf): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core)

2 1

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

Lets try again, put wrong changelog to the mail. Sorry about this. https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. --- Aki Tuomi Open-Xchange oy

2 2

Problems with auth connection
by Fernando Ortega 18 Apr '19

18 Apr '19

Hi, We are having some issues with the auth connection Version: 2.3.5.1, with MySQL and Postfix The server is working fine, and randomly after some days, Dovecot fails to auth: Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eba20 leaked (parent=0x126eb820): auth-request.c:89 Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eb420 leaked (parent=0x0): auth-client-connection.c:338 It's neccesary to restart dovecot, and once restarted the server start to work fine again and deliver emails What do you think i could do? Thank you, best regards Fernando

1 0

ssl_verify_server_cert against SAN?
by TG Servers 18 Apr '19

18 Apr '19

3 5

CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.
by Aki Tuomi 18 Apr '19

18 Apr '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. You can find binary packages at https://repo.dovecot.org/ Yours sincerely, Aki Tuomi Open-Xchange Oy Open-Xchange Security Advisory 2019-04-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3173 (Bug ID) Vulnerability type: CWE-176 Vulnerable version: 2.3.0 - 2.3.5.1 Vulnerable component: json encoder Report confidence: Confirmed Researcher credits: cPanel L.L.C. Solution status: Fixed by Vendor Fixed version: 2.3.5.2 Vendor notification: 2019-04-02 Solution date: 2019-04-11 Public disclosure: 2019-04-18 CVE reference: CVE-2019-10691 CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. See https://wiki.dovecot.org/Authentication/Policy for details on auth policy support. Risk: Determined attacker can prevent authentication process from staying up by keeping on attempting to log in with username containing invalid UTF-8 sequence. Steps to reproduce: Configure dovecot with auth_policy_server_url and auth_policy_hash_nonce set. Attempt to log in with username containing an invalid UTF-8 sequence Observe assert-crash in dovecot logs. Solution: Operators should update to the latest Patch Release or disable auth policy support.

1 0

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 0