- dovecot - dovecot.org

dsync SSL fails since 2.2.15
by Martin Carlé 17 Jan '15

17 Jan '15

Hello list, dovecot ran rock-solid on OSX Mavericks for about 1 year replicating my mail between 2 servers via dsync with SSL as that is well described here: http://wiki2.dovecot.org/Replication After upgrading to 2.2.15, dsync gets stuck with the Error: "Received invalid SSL certificate" even though neither any of the dovecot configs nor the certs, keys or the CA have changed! When I simply outcomment SSL and switch dsync to use tcp (instead of tcps) everthing replications still works like a charm. Please help me to get SSL back working! I did a lot of testing and come up with a concrete QUESTION below, hopefully leading the way out of this trap. What happend ============= 2 days before I upgraded one of the machines to OSX Yosemite. Along with this, I also upgraded to dovecot 2.2.15 via homebrew (unfortunately on both machines at once). During this process, also openssl was updated to "OpenSSL 1.0.1k 8 Jan 2015". If checking the unchanged certs against the CA, however, the results are still "OK". 1st check: OK ========== sudo /usr/bin/openssl verify -CAfile /etc/ssl/ca/dovecotCA.pem /etc/ssl/certs/dovecot_on27_signed_cert.pem Password: /etc/ssl/certs/dovecot_on27_signed_cert.pem: OK 2nd check: OK (providing the CAfile and connecting to the doveadm_port) =========== openssl s_client -CAfile /etc/ssl/ca/dovecotCA.pem -connect on27.linkpc.net:8082 CONNECTED(00000003) depth=1 CN = dovecotCA2, O = dovecot, OU = dovecot, ST = dovecot, C = AF, L = dovecot, emailAddress = mc(a)aiguphonie.com verify return:1 depth=0 CN = on27.linkpc.net, O = dovecot, OU = dovecot, ST = dovecot, C = AF, L = dovecot, emailAddress = mc(a)aiguphonie.com verify return:1 --- Certificate chain 0 s:/CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailA… i:/CN=dovecotCA2/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc@aiguphonie.com --- Server certificate -----BEGIN CERTIFICATE----- dmVjb3RDQTIxEDAOBgNVBAoMB2RvdmVjb3QxEDAOBgNVBAsMB2RvdmVjb3QxEDAO [...] +g== -----END CERTIFICATE----- subject=/CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/… issuer=/CN=dovecotCA2/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com --- No client certificate CA names sent --- SSL handshake has read 1709 bytes and written 487 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: C4DDBA1FA50039FA5D94EF2359BA037B3903D66B6B637CA0733A9216BFCC3996 Session-ID-ctx: Master-Key: 0495D21CA11AA54856D78B48C3DBE9B70EFFB65F13224B430D2B4B2F80F12BE5A89F31454F9577F22F5DDC26FDBAAFAC Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: [...] 0090 - 2d 97 37 15 bd a9 be 68-c1 79 fa dd d8 75 76 3f -.7....h.y...uv? Compression: 1 (zlib compression) Start Time: 1421443766 Timeout : 300 (sec) Verify return code: 0 (ok) --- - Yet, testing dsync yields: ERROR ========================================================================================== sudo -u _vmail doveadm -v sync -u test tcps:on27.linkpc.net Password: doveadm(test): Info: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com doveadm(test): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com doveadm(test): Fatal: Disconnected from remote: Received invalid SSL certificate: certificate signature failure: /CN=on27.linkpc.net/O=dovecot/OU=dovecot/ST=dovecot/C=AF/L=dovecot/emailAddress=mc(a)aiguphonie.com QUESTION ========= So the question clearly is, how does dovecot check the cert against the CA exactly? Is there a call to the openssl cmd or is the library linked into dovecotadm? If liked, what version is used and how can I possibly change it? or: What's wrong with my CA and cert(s) all of a sudden? How can I create new CA for two certs fitting the (new) needs of dovecotadm? THANK YOU! ========================================================================================== Here are my full but rather simple configs of both machines: ========================================================================================== 1st machine: Yosemite # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 14.0.0 x86_64 base_dir = /var/run/dovecot/ default_internal_user = _dovecot default_login_user = _dovenull doveadm_password = secret doveadm_port = 8082 log_path = /usr/local/var/log/dovecot/error mail_home = /var/vmail/%n mail_location = maildir:~/mail mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_on27/passwd.dovecot driver = passwd-file } plugin { mail_replica = tcps:nephelism.linkpc.net replication_full_sync_interval = 1 hour } protocols = imap service aggregator { fifo_listener replication-notify-fifo { user = _vmail } unix_listener replication-notify { user = _vmail } } service auth { unix_listener auth-userdb { group = _vmail mode = 0666 user = _vmail } } service doveadm { inet_listener { port = 8082 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = _vmail } } ssl = required ssl_cert = </etc/ssl/certs/dovecot_on27_signed_cert.pem ssl_client_ca_file = /etc/ssl/ca/dovecotCA.pem ssl_key = </etc/ssl/private/dovecot_on27_signed_key_noenc.pem userdb { args = username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_on27/userdb.dovecot driver = passwd-file } protocol imap { mail_max_userip_connections = 40 } ========================================================================================== ========================================================================================== 2nd machine: Mavericks # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 13.1.0 x86_64 base_dir = /var/run/dovecot/ default_internal_user = _dovecot default_login_user = _dovenull doveadm_password = secret doveadm_port = 8082 log_path = /usr/local/var/log/dovecot/error mail_home = /var/vmail/%n mail_location = maildir:~/mail mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_nephelism/passwd.dovecot driver = passwd-file } plugin { mail_replica = tcps:on27.linkpc.net replication_full_sync_interval = 1 hour } protocols = imap service aggregator { fifo_listener replication-notify-fifo { user = _vmail } unix_listener replication-notify { user = _vmail } } service auth { unix_listener auth-userdb { group = _vmail mode = 0666 user = _vmail } } service doveadm { inet_listener { port = 8082 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = _vmail } } ssl = required ssl_cert = </etc/ssl/certs/dovecot_nephelism_signed_cert.pem ssl_client_ca_file = /etc/ssl/ca/dovecotCA.pem ssl_key = </etc/ssl/private/dovecot_nephelism_signed_key_noenc.pem userdb { args = username_format=%u /usr/local/etc/dovecot_authDBs/authDBs_nephelism/userdb.dovecot driver = passwd-file } protocol imap { mail_max_userip_connections = 40 } -- Fetch my gnupg key: gpg --keyserver pgp.mit.edu --recv-keys 7E3CA33F

1 0

dsync-remote: Error: Failed to set attribute
by Alexander Moisseev 16 Jan '15

16 Jan '15

1. I am looking for backup solution for mdbox with SIS and experimenting with dsync. I am planning to do it like that: doveadm backup [deSISing] => transmitting to remote host => dsync-server [SISing] Is there more convenient method? 2. I have dovecot 2.2.15 on both hosts. The local host is a mail server. Dovecot on the remote host neither running nor configured (I have created an empty dovecot.conf in the config dir). When I tried to back up mailbox from local to remote host with command doveadm backup -P -u user(a)domain.tld \ ssh -c blowfish -i /tmp/vmail/.ssh/id_dsa vmail@remotehost \ doveadm \ -o mail_location=mdbox:/tmp/vmail/domain.tld/user/mdbox \ -o mail_attachment_dir=/tmp/vmail/attachments \ dsync-server I got error messages: dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/roundcube: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/main: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/files/test: Internal attributes cannot be changed directly dsync-remote(vmail): Error: Mailbox INBOX: Failed to set attribute vendor/vendor.dovecot/pvt/server/sieve/default: Internal attributes cannot be changed directly What do that errors mean? Does dsync try to replicate sieve scripts? -- Alexander

1 0

[SERVERBUG] failed to send mail with SA and antispam plugin
by ML mail 16 Jan '15

16 Jan '15

Hello, I am using the antispam plugin of Dovecot with SpamAssassin and in some cases when users move back mails from the Spam folder to their INBOX (false positive) they get the following error message: [SERVERBUG] failed to send mail Does anyone have an idea what could be the issue here? It is quite annoying as the mail then stays in the Spam folder and can not been re-learnt has ham. Best regards ML

4 6

File locking issues
by Oliver Welter 16 Jan '15

16 Jan '15

Hi All, I upgrade my mail server from doveot 1.1.7 to 2.2.13 and encounter problems with file locking issues. The server has around 400 clients using IMAP and I get tons of "Warning: fscking index file .. dovecot.index" and "Error: Corrupted transaction log". Sometimes the transaction log problem is followed by "Panic: file mail-transaction-log.c: line 350 (mail_transaction_log_set_mailbox_sync_pos): assertion failed: (file_offset >= log->head->saved_tail_offset)" I tried all offered locking methods (fcntl, flock, dotlock) without success. The server runs inside a virtual guest (linux-vserver which is similar to LXC) using an overlay filesystem. I suspect the overlayfs but have no idea how to test this, besides - as I understand - dotlock should not rely on the fs locking at all :( I even wonder why the old dovecot worked for nearly 10 years without any problems, even under higher loads. The config is pretty straightforward: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.4.57-vs2.3.3.9-g67e6589-dirty x86_64 Gentoo Base System release 2.2 auth_cache_negative_ttl = 0 auth_cache_size = 50 M auth_mechanisms = plain cram-md5 debug_log_path = /var/log/dovecot-debug.log default_client_limit = 900 default_process_limit = 250 disable_plaintext_auth = no first_valid_gid = 89 first_valid_uid = 89 info_log_path = /var/log/dovecot.log last_valid_gid = 89 last_valid_uid = 89 listen = * lock_method = dotlock login_greeting = Serverpilot.net Mail Service mail_gid = 89 mail_location = maildir:~/.maildir mail_uid = 89 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service imap-login { process_min_avail = 5 service_count = 0 } ssl_cert = </var/qmail/control/servercert.pem ssl_cipher_list = ALL:!EXPORT:!LOW:!MEDIUM:!aNULL:+RC4:@STRENGTH ssl_dh_parameters_length = 2048 ssl_key = </var/qmail/control/servercert.pem ssl_protocols = !SSLv2 !TLSv1.2 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 25 } Any ideas are welcome. Oliver -- Protect your environment - close windows and adopt a penguin!

1 0

Questions regarding imaptest
by rub zorghy 15 Jan '15

15 Jan '15

Hi, The measurements were created under the following conditions : • operating system : Red Hat Enterprise Linux Server release 6.6 (Santiago) kernel in version 2.6.32-504.el6.x86_64 • virtual server (VMware) with an Intel(R) Xeon(R) 4vCPU E5649 x 2,526 GHz (2 cores per virtual socket) and 4 GB RAM • 7,200 RPM SATA 1TB (FC SAN IBM System Storage N3400) • all file systems had been formated in ext4 • Dovecot v.2.0.9 • imaptest v.1.0.0 • LDAP 389 Directory Server v.1.2.2 • free pagecache, dentries and inodes: echo 3 > /proc/sys/vm/drop_caches and services restarted before the test "Tuning" based upon the book « *Dovecot: POP3/IMAP servers for enterprises and ISPs* » Peer Heinlein : ---%<------------------------------------------ imap {} (10-master.conf). service imap { [...] process_limit = 8192 [...] } auth {} service auth { [...] client_limit = 9516 [...] } process_min_avail = 16 ---%<------------------------------------------ mail_max_userip_connections = 100 The test results shows : Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 100% 30% 5% 324 142 128 263 299 405 92 153 320 336 335 800/800 212 92 92 182 166 233 59 87 178 201 202 800/800 - 4051 stalled for 16 secs in command: 8 APPEND "INBOX" () {3251+} 315 160 134 300 275 400 85 136 300 317 317 800/800 - 4051 stalled for 17 secs in command: 8 APPEND "INBOX" () {3251+} 247 130 163 292 251 366 99 115 239 240 240 800/800 222 122 117 234 279 383 112 147 263 222 222 800/800 188 93 94 177 168 232 65 87 162 196 195 800/800 290 126 119 260 262 383 102 126 283 282 283 800/800 240 125 107 243 259 353 102 130 253 256 256 800/800 276 158 144 291 280 400 101 149 266 261 261 800/800 254 95 89 189 235 313 78 118 243 253 253 800/800 82 829 926 861 722 593 455 628 1695 2252 4 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 100% 30% 5% 148 59 55 126 119 174 43 64 130 147 147 800/800 - 8770 stalled for 16 secs in command: 4 FETCH 1:2 (INTERNALDATE UID INTERNALDATE) 261 128 139 247 252 369 101 125 258 269 269 800/800 302 159 158 307 282 398 109 126 296 298 297 800/800 234 96 118 239 270 369 98 138 357 428 427 800/800 361 213 220 450 383 596 151 197 240 165 166 800/800 192 93 92 206 256 352 104 118 297 289 290 800/800 - 9806 stalled for 16 secs in command: 4 FETCH 1 (RFC822.SIZE) 245 85 72 162 128 190 52 73 157 174 173 800/800 - 9806 stalled for 17 secs in command: 4 FETCH 1 (RFC822.SIZE) 294 152 165 348 360 526 136 179 313 308 309 800/800 272 87 79 174 164 229 54 85 218 230 230 800/800 218 152 152 310 325 467 117 152 265 236 221 798/800 119 830 852 859 707 566 511 702 1672 2161 6 ms/cmd avg I have three questions : 1) how to interpret each row except the last one ? 2) how to explain the stalled commands ? 3) why benchmark shows too few read disk I/O ? Thanks so much, rub

1 1

Re: dovecot.org slow & imap search now blazing fast
by Joseph Tam 15 Jan '15

15 Jan '15

From: Laeeth Isharc <laeeth(a)laeeth.com> > In case you were not aware, I wanted to let you know that dovecot.org > has been very slow (often almost unusable) for at least several days now. Not for me as of the writring of this Email. Seems OK to me. Check your browser, network, etc. Joseph Tam <jtam.home(a)gmail.com>

1 0

HG e3640ccaa76d crashes upon IMAP SEARCH
by Thomas Leuxner 15 Jan '15

15 Jan '15

$ doveconf -n | head # 2.2.15 (e3640ccaa76d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 # OS: Linux 3.16.0-0.bpo.4-amd64 x86_64 Debian 7.8 $ /usr/lib/dovecot/imap -u tlx(a)leuxner.net * PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE NOTIFY QUOTA ACL RIGHTS=texk] Logged in as tlx(a)leuxner.net a select "Shops/Amazon" * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $NotJunk NotJunk) * OK [PERMANENTFLAGS (\Answered \Flagged \Seen \Draft $NotJunk NotJunk \*)] Flags permitted. * 491 EXISTS * 0 RECENT * OK [UNSEEN 491] First unseen. * OK [UIDVALIDITY 1213986801] UIDs valid * OK [UIDNEXT 568] Predicted next UID * OK [HIGHESTMODSEQ 1029] Highest a OK [READ-WRITE] Select completed (0.003 secs). b search charset utf-8 body "Sleeve" imap(tlx(a)leuxner.net): Panic: file message-decoder.c: line 346 (message_decode_body): assertion failed: (ctx->translation_size <= sizeof(ctx->translation_buf)) imap(tlx(a)leuxner.net): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x7749f) [0x7ffe68e6d49f] -> /usr/lib/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7ffe68e6d57a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7ffe68e1df65] -> /usr/lib/dovecot/libdovecot.so.0(message_decoder_decode_next_block+0x688) [0x7ffe68e5c858] -> /usr/lib/dovecot/libdovecot.so.0(message_search_more+0xa1) [0x7ffe68e60881] -> /usr/lib/dovecot/libdovecot.so.0(message_search_msg+0x5b) [0x7ffe68e60a4b] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xa9b7b) [0x7ffe69187b7b] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_search_args_foreach+0x45) [0x7ffe6915d675] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xa951a) [0x7ffe6918751a] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xab76a) [0x7ffe6918976a] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0xe2) [0x7ffe69189e32] -> /usr/lib/dovecot/modules/lib90_stats_plugin.so(+0x2daa) [0x7ffe66dc3daa] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x27) [0x7ffe691627a7] -> /usr/lib/dovecot/imap() [0x41da2f] -> /usr/lib/dovecot/imap() [0x41e0a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0xaa) [0x7ffe68e7f6ca] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x69) [0x7ffe68e804e9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7ffe68e7f549] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7ffe68e7f5c8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7ffe68e23433] -> /usr/lib/dovecot/imap(main+0x2a1) [0x40c591] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7ffe68a88ead] -> /usr/lib/dovecot/imap() [0x40c6f5] I tried to make it dump a core but failed... Regards Thomas

2 2

attn rick van rein (midget)
by Laeeth Isharc 14 Jan '15

14 Jan '15

From 11 Oct 2013 (Rick van Rein) "Hello, I love Dovecot, but when developing a small IMAP tool, I ran into searching behaviour can easily be optimised. Please forgive a rather detailed suggestion. This was on Dovecot 1.2.15 on Debian Squeeze. My tool? It's called "midget" and retrieves documents from an IMAP box based on their mid: or cid: identifier, as per RFC 2392. I thought this would be useful to retrieve email attachments into a remote shell environment. When using Kerberos, the credentials and a strong hint of one's mail address are already present anyway, DNS SRV does the rest. If you want to see the early code, I'll be happy to share it here." Hi Rick. Thanks for the suggested optimisation - I am not sure if it is you who I have to think for contributing towards making IMAP search fast again. In any case, if you see this I would be interested to see the source for midget if you are willing to share. If you don't want to post to the list then my email is laeeth at laeeth.com Thanks. Laeeth

1 0

dovecot.org slow & imap search now blazing fast
by Laeeth Isharc 14 Jan '15

14 Jan '15

Hi. In case you were not aware, I wanted to let you know that dovecot.org has been very slow (often almost unusable) for at least several days now. Also, I upgraded my dovecot from 2.2.10 to 2.2.15. Thank you for fixing IMAP search. I have c. 2mm messages, and it had become unusable before but it is now very fast. (I saw a reference to an optimisation on the mailing list from back in Oct 2013, so maybe that was it). Regards, Laeeth

1 0

pigeonhole ereject vs reject
by Robert Blayzor 14 Jan '15

14 Jan '15

Currently pigeonhole supports reject which would generate a NDR for each message. (If I understand the current documentation) Using Dovecot LMTP it would be more optimal to kick a 5xx back to the primary MTA to reject the delivery rather than generating more back scatter NDRs. Anyone know if this is possible now (to forgo the NDR)'s or do we need to wait for ereject ? If so, how much work is involved? -- Robert inoc.net!rblayzor http://inoc.net/

2 7

blowfish crypt
by Edgar Pettijohn 14 Jan '15

14 Jan '15

I'm setting up a new server and am planning on using blowfish crypt. This page from the wiki http://wiki2.dovecot.org/Authentication/PasswordSchemes says the password will begin with $2a$, however mine are starting $2b$. Is this wrong on the wiki or am I doing something wrong? Just want to catch this before it becomes a problem. Thanks, Edgar

1 1

dovecot and glusterfs
by Michael Schwartzkopff 14 Jan '15

14 Jan '15

Hi, I did some experiments with dovecot on a glusterfs on the active nodes without a director. So I had concurrent access to the files. With the help of the available documentation about NFS and fcntl locks I managed to find out the following: With the plain mbox format dovecot seems to apply and to honor the fcntl locks. But since this format is not used any more in real setups, it is useless. With mdbox and maildir format I could reliably crash my mail storage just by delivering mails to the both dovecots via LMTP to the same user. In maildir dovecot seems not the set / respect the fnctl locks of the index file. dotlocks do not seems to work either with mdbox. So I think the only solution os to use a director in a real world setup. Or is there any non-obvious trick that I did not check? I think it would be really nice if dovecot could use glusterfs for realy scalable postbox servers. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

4 6

Proxying when src and dest on non standard ports
by Thomas HUMMEL 13 Jan '15

13 Jan '15

Hello, I want to test dovecot proxying, on a user basis, in a simple set up (proxy, no proxy_maybe and forward the passwd to the remote server). This seem pretty simple except that, in order to test it alongside the production server, I set up 3 servers : . the proxy, listening to pop and imap on non standard ports 9143, 9993, 9110, 9995 . a proxy destination for some users, listening on 10143, 10993, 109110, 10995 . another proxy destination for some other users, listening on 20145, 20993, 209110, 20995 But there seems to be only one 'port' extra_field, so how can I handle the proxying of both IMAP and POP3 (especially for the same user who can use both) ? Thanks. -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

1 0

Re: dovecot-2.2.15 process dovecot/imap segfaults when dict process has troubles
by Marcin Mirosław 13 Jan '15

13 Jan '15

W dniu 13.01.2015 o 13:53, Lazy pisze: > I can't reproduce this with redis dict. > > Could You provide us with a doveconf -n ? > Does this also happen with other dict engines ? Working configuration: auth_cache_size = 64 k auth_cache_ttl = 10 mins auth_master_user_separator = * auth_mechanisms = plain login deliver_log_format = msgid=%m: from=%f: phys=%p: virt=%w %$ dict { domainquota = pgsql:/etc/dovecot/dovecot-dict-sql-domain.conf.ext lastlogin = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 999 first_valid_uid = 999 last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_gid = 999 mail_location = maildir:~/.maildir:INDEX=/data/poczta/indeksy/%d/%n mail_log_prefix = "%s(%u) <%{session}>: " mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib mail_temp_dir = /data/poczta/tmp mail_uid = 999 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include vari ables body enotify environment mailbox date ihave duplicate namespace { location = maildir:%%h/.maildir:INDEX=/data/poczta/indeksy/shared/%d/%n prefix = shared/%%n/ type = shared } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Wiadomości-śmieci { special_use = \Junk } mailbox Wiadomo&AVs-ci-&AVs-mieci { special_use = \Junk } prefix = separator = / } passdb { driver = pam master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/data/poczta/acl/global-acls:cache_secs=60 acl_shared_dict = file:/data/poczta/acl/shared-mailboxes.db fts = squat fts_squat = partial=4 full=10 last_login_dict = proxy::lastlogin last_login_key = lastlogin/%u/%s/%r listescape_char = \ quota = dict:User quota::proxy::quota quota_rule2 = Trash:storage=+100M sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/sieve_default_spam-to-junk.sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 1M stats_refresh = 30 s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } postmaster_address = postmaster(a)example.com protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth-worker { user = root } service auth { unix_listener auth-client { group = mail mode = 0660 } unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = poczta mode = 0660 } } service stats { fifo_listener stats-mail { group = poczta mode = 0660 } } ssl_cert = </etc/ssl/private/example.com.crt ssl_cipher_list = DEFAULT:!EXPORT:!LOW:!MEDIUM:!MD5 ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/example.com.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 25 mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib imap_acl imap_quota imap_stats imap_zlib last_login } protocol pop3 { mail_plugins = acl fts fts_squat listescape quota notify mail_log stats zlib last_login } Then I'm adding: quota = dict:Quota:%d:proxy::domainquota and I'm doing: chmod 000 /etc/dovecot/dovecot-dict-sql-domain.conf.ext Next I'm restarting dovecot, trying to use IMAP account (reading, removing emails etc.) and from time to time dovecot/imap throws core. Marcin

1 0

Moving or "upgrading" from MD5 to SSHA512
by Jyri Hovila [Turvamies.fi] 13 Jan '15

13 Jan '15

Hello, world! I have a long-running Dovecot & Postfix installation using PostgreSQL back-end. Until now I've been using MD5 hashing but would like to "upgrade" to the salted SSHA512. Is there a way to configure Dovecot so that it would automatically detect the type of the hash stored in the database, so that users who have changed their password (and thus being hashed with SHA512) and users still having an MD5 hash would both be able to authenticate at the same time? Yours, Jyri -- +358-50-5632104 (24/7) +358-46-8822157 (backup) jyri.hovila(a)turvamies.fi

3 3

dovecot-2.2.15 process dovecot/imap segfaults when dict process has troubles
by Marcin Mirosław 13 Jan '15

13 Jan '15

Hi! I hope it's not too late to wish all the best in 2015 year! I'm writing the email because I've noticed that if dict process has any troubles with configuration then dovecot/imap throws segfault: log: Jan 12 16:51:59 mail dovecot: dict: Error: Failed to initialize dictionary 'lastlogin': dict pgsql: Can't open configuration file /etc/dovecot/dovecot-dict-sql.conf.ext: Permission denied Jan 12 16:51:59 mail dovecot: dict: Error: Failed to initialize dictionary 'lastlogin': dict pgsql: Can't open configuration file /etc/dovecot/dovecot-dict-sql.conf.ext: Permission denied Jan 12 16:52:00 mail dovecot: master: Error: service(imap): child 24243 killed with signal 11 (core dumped) and here is backtrace: (gdb) bt #0 io_remove_full (_io=0x7fb02b0afce0, closed=false) at ioloop.c:119 #1 0x00007fb02aac5f40 in io_remove (io=<optimized out>) at ioloop.c:154 #2 0x00007fb02aa841b2 in client_dict_finish_transaction (dict=dict@entry=0x7fb02b0afc20, id=<optimized out>, ret=ret@entry=-1) at dict-client.c:274 #3 0x00007fb02aa84286 in client_dict_disconnect (dict=dict@entry=0x7fb02b0afc20) at dict-client.c:459 #4 0x00007fb02aa8493d in client_dict_deinit (_dict=0x7fb02b0afc20) at dict-client.c:519 #5 0x00007fb02aa28ece in last_login_dict_deinit (user=<optimized out>) at last-login-plugin.c:34 #6 0x00007fb02aa28f92 in last_login_user_deinit (user=0x7fb02b0ab400) at last-login-plugin.c:46 #7 0x00007fb02ab820bf in mail_user_unref (_user=_user@entry=0x7fb02b0bbdc8) at mail-user.c:163 #8 0x00007fb02ac1ee0d in client_default_destroy (client=0x7fb02b0bbd50, reason=<optimized out>) at imap-client.c:284 #9 0x00007fb02ac29549 in client_kill_idle (client=0x7fb02b0bbd50) at main.c:105 #10 0x00007fb02ac296a5 in client_kill_idle (client=0x7fb02b0bbd50) at main.c:129 #11 imap_die () at main.c:121 #12 0x00007fb02aac661d in io_loop_call_io (io=0x7fb02b093ce0) at ioloop.c:498 #13 0x00007fb02aac7a15 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x7fb02b091740) at ioloop-epoll.c:220 #14 0x00007fb02aac66d5 in io_loop_handler_run (ioloop=ioloop@entry=0x7fb02b091740) at ioloop.c:545 #15 0x00007fb02aac677a in io_loop_run (ioloop=0x7fb02b091740) at ioloop.c:522 #16 0x00007fb02aa5b5aa in master_service_run (service=0x7fb02b0915d0, callback=<optimized out>) at master-service.c:566 #17 0x00007fb02ac116cd in main (argc=<optimized out>, argv=<optimized out>) at main.c:412 Marcin

1 0

[PATCH] Make Delivered-To optional
by Nagy, Attila 13 Jan '15

13 Jan '15

Hi, I've read at least one e-mail on this list about making delivered-to in lmtpd optional, but now I need this too, so I made a patch. The default remains as is now (enabled). Rationale: I would like to dsync users and I have catchall POP mailboxes (meaning: a single mailbox gets the mails for a lot of e-mail addresses). If I deliver the e-mails to Dovecot's lmtpd as the original RCPT TO, the Delivered-To header can be used for the POP client to sort the messages on their side to the correct mailbox, but because Dovecot sees this as a new user, it adds it to the replicator.db. Now imagine a single mailbox with thousands of e-mail addresses, this will make thousands of entries in replicator.db, all of which Dovecot would like to replicate independently... If I deliver to the mailbox uid, Dovecot dsync will work right (only one user will be added, no matter how many different e-mail addresses end up in this mailbox), but the Delivered-To will contain the uid, so the user can't use that to sort the messages into their final destination on their side. So the solution here is that I disable the addition of Delivered-To header in Dovecot (because it doesn't know what is the original address) and add it in an upper layer, so during the lmtp transaction, the message will already contain the right value. Currently Dovecot adds another Delivered-To line, which confuses the clients. Please add this feature to Dovecot. Thanks,

1 0

Re: Maildir permissions on creation?
by Von Random 13 Jan '15

13 Jan '15

Yes, and it is not my use case, sadly. ACLs are meant for imap, not filesystem access and mail_access_groups is also useless for some reason. It just does not change anything. Probably because I don't use mail_location and variables when I provide path for home. (It's stored as is in a database on mailbox creation.) 26.12.2014, 12:07, "Tobi" <tobster(a)brain-force.ch>: > Have you checked the dovecot wiki for 'filepermissions in shared mailboxes' ? > Explains how dovecot set ACL when creating mailboxes > > Am 26. Dezember 2014 09:37:37 MEZ, schrieb Von Random <von(a)vdrandom.org>: >> Err, my bad, of course 0640 on files in case of setgid on directories. >> >> 26.12.2014, 11:36, "Von Random" <von(a)vdrandom.org>: >>> The main reason is that I don't want to provide backup user with >> unnecessary write permissions within maildirs and mail user within >> backup logs dir. I was talking about mail_user:mail_group 0750 on dirs >> and 0640 on files. (Or, possibly, mail_user:backup_group 2750 and >> 2640.) >>> 26.12.2014, 11:19, "Tobi" <tobster(a)brain-force.ch>: >>>> Whats the reason you do not want to use default dovecot user. Your >> idea would assume that at least the group must have write access. For >> me a no-go on mailboxes. >>>> Am 24. Dezember 2014 13:21:15 MEZ, schrieb Von Random >> <von(a)vdrandom.org>: >>>>> Hello. >>>>> >>>>> In my configuration dovecot reads home from mysql and uses no >> variables >>>>> within it. It uses Maildir++ storage with virtual users. I also >> happen >>>>> to use LMTP. >>>>> >>>>> I want to use a backup solution that does not involve running >> itself as >>>>> root. Neither do I want to run it as dovecot's mail user. >>>>> >>>>> And there lies the problem: dovecot creates maildirs with 0700 and >>>>> files within them inherit that set of permissions. And there seems >> to >>>>> be no sane way to control it. I think I've figured out what to >> patch in >>>>> order to change that default, but if possible, I'd like to avoid >> doing >>>>> that. >>>>> >>>>> tl;dr: is it possible to change the default set of permissions for >> new >>>>> maildirs created by dovecot? >>>> - -- >>>> Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail >> gesendet. >>>>>> -----BEGIN PGP SIGNATURE----- >>>>>> Version: APG v1.1.1 >>>>>> >>>>>> iQI7BAEBCgAlBQJUnRoiHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK >>>>>> CRA1HOYlqGik5L9iD/9FIE2JzWfB7fWJEbI3vVg+ar4LRGwW1xNIf8ahlytPbsmH >>>>>> D9dFP3kWpJH6TO41AksNjz/FxHcUqSrlsKYTFUsDZCyb9Zyxd8Jv+dH04FwUzw+y >>>>>> kq+ayoylnTN7Q8mQnqkUpWEuYd5ohWbbUUSguwzN8Zd1T4jCFR9/Lvu0cweE6meu >>>>>> mBGwvXBbfBP4El+mAM2lKnoMXQpMycS6aX7FwQ/fBaoWSkzg/2az69UtqG6LLF67 >>>>>> ZhJkbn17cpT3y/l/2nV5urdcFVh8RoSXNuYyMN4r7IDKQ6BPsneD+839LS9X/gP/ >>>>>> QMuo5nO5xdx4q1bT9gtv1zz5eKAJ1f3R2oPZyxdpiV5PruSY3J3kvu0cF0aJvQF6 >>>>>> +s0iDsoDBcueB6JEUnYAarteWvBvxRnqb8ytju1xbIEkKLZtaS8Gf2cpZ8eA+Ha/ >>>>>> D0zkYfq7bt+Ra7BY6Qh7XMfiN5z9eWe5RqOmVLZRLf9N75U6wWa+fmXpvlqEtGNV >>>>>> pKsgif/ivCHiA24+JSJ1PBRjwO36Tu4MsSlT2WnkvyFBQzFzg9T00fl+uTXzgNEz >>>>>> SBta2wmXk9XVJ9mPzfNrAaAA3+T6H90Sj1CbRt7NZx30UdwYoIL5XXEtnG0p1XdS >>>>>> moe91H2UE+NT+jgj7emAOLxJf86vIwiHCqI0Zl/7wVNJEnKBXJP5WIHcdEDEHg== >>>>>> =Tl/z >>>>>> -----END PGP SIGNATURE----- > > - -- > Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet. > -----BEGIN PGP SIGNATURE----- > Version: APG v1.1.1 > > iQI7BAEBCgAlBQJUnSVbHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK > CRA1HOYlqGik5GvTEACYhFfqS5hK4rAoHCzDd5vFwCLIE/ESheJhREbpewE4k7Nq > BGR1hKygYeAnj3w1CB9R4sgRBOTHSpRuIzk1ZMId5UuQOBxy8ukRzA5xiAoP22lw > AxB6Ek7e7VLz0998GmoN7uw1t5tczR1SkHscs0XfuBCBJrvo79DHYs7CP18oDTic > m5NVJS0MZzJGWPSDGwN6WPwRbLZMTZHc79h+WTmYz9Fzet2As71npvP0PiLd4hQP > xMlgUXCF1vXTUPUGf/NtQfy/xjaww4sEMqOxpigjLLMmnz+OFPo9Mar0uWvNBCgq > 3rTUqAUaMcLS8ANyvqzPXXba67dl+rNYuK33tWom+H17JzNf1rdYKxtc7IVQgm/E > RfYhIejH9yQR0/8CHw+ySF3mJdiQsZHMKL4PwXhRzp9OuOU8RZts1bve8pJEHGSr > ZQjqjiNB/DyE0s9uNh94U58mwGT8FKHQPR52EPF2WyNlyet1aYUCNQlXm2Qe+3FI > k4D4eJpRfWIHS5x7NALuwrki+/OqFvDphzKCTmhIC2Qa8UnKvxaS9VccW2Z5D9R9 > PHoOb2pgm5bIOUtsWUCykDiTwh5IA0jReoGPRlXmFK/tuhHawdrbfUlQ/YrVAX8w > p+FhchB5e5LNnBOjIXDB9c+viuobF3qo3uoOqjAwGTkEqIdwsiswCUPfjZJD+A== > =XfBH > -----END PGP SIGNATURE-----

2 1

pigeonhole: upgrade 0.4.3 -> 0.4.6 broke script storage
by Petar Bogdanovic 12 Jan '15

12 Jan '15

Hi, I ran into some troubles while upgrading pigeonhole: crane dovecot: lda(petar): Error: sieve: Failed to access user storage (temporary failure) crane dovecot: lda(petar): Error: sieve: file storage: Could not find storage root directory; path was left unconfigured and autodetection failed After reading through the changelog, I noticed that there have been some changes in the script storage location syntax but that old prefix-less paths should still work fine. My lda-configuration is very simple: # lda protocol lda { mail_plugins = sieve postmaster_address = <snip> } plugin { sieve = /data/dovecot/user/%u.sieve sieve_extensions = +editheader sieve_max_redirects = 50 } And even if I change $sieve to: sieve = file:/data/dovecot/user/%u.sieve the error messages disappear but based on the sudden unfiltered wave of mails in my INBOX that I usually store somewhere else, I guess the path still doesn't work. Any ideas? Thanks, Petar Bogdanovic

2 3

Dovecot replication over TCP/SSL, certificate error
by Jonas Plitt 12 Jan '15

12 Jan '15

Hi All, I'm running TCP-based dsync replication on two dovecot nodes. Nowdays i tried to enable SSL (TCPS). I changed mail_replica prefix from tcp:* to tcps:* and added ssl=yes to the inet_listener. Then on running *doveadm sync* i'm getting the following message: " *doveadm(example(a)example.com <example(a)example.com>): Error: Couldn't initialize SSL context: Can't load CA certs from directory /etc/ssl/certs: error:02001024:system library:fopen:File name too longdoveadm: Error: Failed to iterate through some users*" this is my config (part): *ssl_cert = </etc/ssl/certs/alpha-servers.pemssl_key = </etc/ssl/private/alpha-servers.keyssl_ca = </etc/ssl/certs/startcom-ca-bundle.pemssl_client_ca_dir = /etc/ssl/certsssl_client_ca_file = </etc/ssl/certs/startcom-ca.pemssl_protocols = !SSLv2 !SSLv3* The file startcom-ba-bundle contains the complete chain. The file startcom-ca contains only the ca certificate. Can anybody help, please? -- with kind regards, Jonas

2 2

Solaris 10 make check core dumps
by Brian Eliassen 12 Jan '15

12 Jan '15

Hello everyone, I'm doing a standard build on Solaris 10 with Dovecot 2.2.15 without anything fancy: ./configure make make check make install Configure output looks like this: *** Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : poll I/O notifys .... : none SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file shadow pam checkpassword : -bsdauth -sia -ldap -sql -vpopmail userdbs ........ : static prefetch passwd passwd-file checkpassword : -ldap -sql -vpopmail -nss SQL drivers .... : : -pgsql -mysql -sqlite Full text search : squat : -lucene -solr *** Everything works properly including the "make" until I try a "make check" at which time I receive the following failure. It would appear that something in test-http-auth is most unhappy. http auth challenges valid [0]: parse `Basic realm="WallyWorld"' ..... : ok http auth challenges valid [0]: [0]->scheme = Basic .................. : ok /bin/bash: line 1: 28057 Segmentation Fault (core dumped) ./$bin make[2]: *** [check-test] Error 1 make[2]: Leaving directory `/export/home/brian/software/dovecot-2.2.15/ src/lib-http' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/export/home/brian/software/dovecot-2.2.15/ src' make: *** [check-recursive] Error 1 This creates: -rw------- 1 root 1000 3523871 Jan 7 10:43 core Can this be safely ignored and I can proceed to "make install" or should I look somewhere else for the problem? Here is the mdb backtrace: $ mdb test-http-auth core Loading modules: [ libc.so.1 ld.so.1 ] > ::stack libc.so.1`strlen+0x50(29487, ffbffb00, ffbff43d, 0, 0, 0) libc.so.1`vsnprintf+0x70(4f2c0, 10f, 29478, ffbffaf8, 10, ff1c7078) t_noalloc_strdup_vprintf+0x3c(4f2c0, ffbffaf8, ffbffa2c, 1, 19, 0) p_strdup_vprintf+0xc(4cb90, 29478, ffbffaf8, ff1c759c, 4cc38, 4cb8c) t_strdup_printf+0x38(29478, 0, 0, 61fefeff, 80808080, 1010101) test_http_auth_challenges_valid+0x150(29000, 29400, 0, 4f250, 4cbb8, 0) test_run_funcs+0x24(4ca74, 1c00, ff1c7940, 4, ff312a00, ff13866c) test_run+0xc(4ca74, ffbffc7c, ffbffc84, 4f030, ff310140, 0) _start+0x5c(0, 0, 0, 0, 0, 0) Any help would be greatly appreciated. Brian

2 2

Dovecot on Fedora 20 or 21
by David Mehler 10 Jan '15

10 Jan '15

Hello, Is anyone running Dovecot on either a Fedora 20 or 21 system? I'm having an issue, on a system reboot, which I admit does not happen often, Dovecot fails to start in the systemctl list, output is status failed. The issue seems to be Dovecot can not bind to the ipv6 address. Now later if I manually log in to the box and start dovecot it works just fine no problems. I've googled and seen similar issues to this. Does anyone have a solution? Thanks. Dave.

4 3

pop3 seen
by David Saez 10 Jan '15

10 Jan '15

Hi Is there a way to know if a message has been dowloaded via pop3 and not seen via imap ?

4 5

Re: dovecot on wheezy, best ssl configuration ?
by Joseph Tam 10 Jan '15

10 Jan '15

ml(a)ruggedinbox.com writes: > Our smtp server is postfix, can you please suggest a better > 'ssl_protocols' and 'ssl_cipher_list' configuration ? > We are running Debian 7 Wheezy A useful command to know is "openssl ciphers" run on the server that will tell you the ciphers available given a protocol and cipher list spec. If it comes out to empty, your client won't be able to negotiate any SSL sessions, and you'll have include more ciphers. For example, TLSv1 protocol minus any low-grade encryption or SSLv2 ciphers: $ openssl ciphers -tlsv1 'ALL:\!LOW:\!SSLv2' ADH-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:ADH-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:ADH-DES-CBC3-SHA:EXP-ADH-DES-CBC-SHA:ADH-RC4-MD5:EXP-ADH-RC4-MD5:EDH-RSA-DES-CBC3-SHA:EXP-EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC3-SHA:EXP-EDH-DSS-DES-CBC-SHA:DES-CBC3-SHA:EXP-DES-CBC-SHA:IDEA-CBC-SHA:EXP-RC2-CBC-MD5:RC4-SHA:RC4-MD5:EXP-RC4-MD5 Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot on wheezy, best ssl configuration ?
by ml＠ruggedinbox.com 10 Jan '15

10 Jan '15

Hi all, when hardening dovecot against the POODLE vulnerability, we followed the advise to disable SSL2 and SSL3 but this is giving problems with some email clients (claws-mail). ssl_protocols = !SSLv2 !SSLv3 results in the following error: dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=XXX, lip=XXX, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<2C8jBjIMmQBVGNd1> Our smtp server is postfix, can you please suggest a better 'ssl_protocols' and 'ssl_cipher_list' configuration ? We are running Debian 7 Wheezy Thank you, RuggedInbox team

4 8