- dovecot - dovecot.org

Re: under another kind of attack
by Davide Marchi 31 Jul '17

31 Jul '17

> From: Olaf Hopp <Olaf.Hopp(a)kit.edu> > Davide, > yours is all postfix and thus has got no overlap with dovecot. > So no interference. > Olaf Yes, I know, but I preferred not to give anything for granted ;-) Many Thanks Olaf!

1 0

Large Scale Cluster using dsync and tagged director
by Matt Bryant 31 Jul '17

31 Jul '17

Just been reading up on some of dovecot features and was wondering if anyone had played around with large scale systems made up from mutliple small dsync clusters and using tagged director to split users between nodes of a sync'd cluster (rather than nfs). I know traditionally its been shared storage and multiple nodes and dovecots own doco suggest dsync for several thousands rather than millions but given the cloud seems to be all about replication what about many smaller nodes using dsync and scaling horizontally ? The only issue is how does director scale when there are serveral(or rather lots of) 'tags' ... in fact what are the limitations with director ? Matt -- <https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campai…>

1 0

dovecot auth errors for a new user
by Ruben Safir 31 Jul '17

31 Jul '17

I've been running dovecott without trouble for quite a why and now when I added a new user, it is not accepting the user and I can not track the problem. It says find more information in the server log, but it is not in /var/log/messages or /var/log/mail.err and nothing with lsof dovecot|grep log show anything to tail www:~ # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.7-53-pae i686 openSUSE 13.2 (i586) base_dir = /var/run/dovecot/ managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.key userdb { driver = passwd } www:/etc/dovecot # dovecot --version 2.2.13 Sending of password for user facebook did not succeed. Mail server mrbrklyn.com responded: Internal error occurred. Refer to server log for more information. 2017-07-30T15:41:58.803006-04:00 www dovecot: pop3-login: Login: user=<facebook>, method=PLAIN, rip=10.0.0.62, lip=96.57.23.82, mpid=25269, TLS, session=<D5J/G45VQgAKAAA+> 2017-07-30T15:41:58.812827-04:00 www dovecot: pop3(facebook): Error: user facebook: Initialization failed: Namespace '': Mail storage autodetection failed with home=/home/facebook 2017-07-30T15:41:58.816903-04:00 www dovecot: pop3(facebook): Error: Invalid user settings. Refer to server log for more information. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

2 4

Re: under another kind of attack
by Davide Marchi 30 Jul '17

30 Jul '17

Hi to all, @Olaf Hopp I've this filter enabled for fail2ban, my question is: could my filters overlap or interfere with those suggested by you? this is my filter: Contents of /etc/fail2ban/jail.conf: [postfix] # Ban for 10 minutes if it fails 6 times within 10 minutes enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log maxretry = 6 bantime = 600 findtime = 600 Contents of /etc/fail2ban/filter.d/postfix.conf: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision$ [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # # Jul 11 02:35:08 mail postfix/smtpd[16299]: lost connection after AUTH from unknown[196.12.178.73] failregex = lost connection after AUTH from unknown\[<HOST>\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = Many thanks!

2 1

Re: under another kind of attack
by Joseph Tam 28 Jul '17

28 Jul '17

(I think I am testing other readers' patience, so if you want to follow-up, you can Email me directly.) > but how often do you have to type your username ? Not often, but I'm not talking the typical case. The larger the population you serve, the more circumstances you'll have to cover. > Only on the initial config of your mailer. After that you are done. Mail reader setups by users is often an error prone process, judging from the number of times I have to correct a setup. This is especially true for an educational institution that typically has a large turnover of accounts. If a user gets it initially wrong, then fixes their mistake, they can't get it to work despite trying all sorts of config variations, not realizing it can't be resolved anymore. Result: trouble call. If someone blows it setting on a multi-user workstation, other users with a working setups can't log in. Result: trouble call. If a student flubs their credentials, all the roommates behind their residential NAT gateway suffer. Result: trouble call. If a user screws up using an external service that slurps their mail (e.g. Gmail, Yahoo, uniboxapp, etc.), or worse, someone malicious does it on puropse, all other users of this service will be DoS'd. Result: trouble call(s). If a user acquires a DHCP address in a polluted network ..., well you get the idea. Not to mention ex-users who forget to remove their mail accounts from their smartphones, leaving a trail of blacklist entries in their wake as they travel from coffee shops to other public WiFi hotspots. > So this is why I decided to use two distinct jails with > different policies. It seems to work reasonable well. Until it doesn't. If it works for you, more power to you. The cost/benefit of a hair-trigger blacklist policy is that it saves you a few log entries showing futile attempts at finding weak passwords (because you have strong passwords, don't you?) at the risk of dealing with any of the above situations. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 27 Jul '17

27 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> wrote: > And I have a new one just for "unknown user" and here my bantime and findtime > are much bigger and the retries are just '2'. So here I'm much harsher. > I'll keep an eye on my logs and maybe some more twaeking is necessary. Just be careful about typos (like twaeking!): users could simply misspell their username, or get mixed up with some another account or alias. This is why I favour targetting known bad accounts, not merely accounts that don't exist. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission
by Davide Marchi 26 Jul '17

26 Jul '17

> From: Thomas Leuxner <tlx(a)leuxner.net> >> cat /etc/dovecot/dovecot-acl >> * user=booking(a)hotelsangiorgioriccione.com lrwsi >> * user=info(a)hotelsangiorgioriccione.com lrwsi > Hi Davide, > > For LMTP to file the mails you need to add the p flag (POST). Well, I've added the "p" flag and now I will monitor the situation ;-) PS Just as an additional note, just after making this change and reload Dovecot I have detected (oneshot) this error message: Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF But now everything seems to work well (let's hope) ;-) Many thanks Thomas!

1 0

Return extra fields from passwd userdb
by Michele Petrella 26 Jul '17

26 Jul '17

Hi all. I use dovecot 2.2.29.1. Output of dovecot -n: # 2.2.29.1 (e0b76e3): /var/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) # OS: Linux 3.10.55-gentoo i686 SuSE Linux 7.1 (i386) debug_log_path = /var/log/dovecot/dovecot_debug.log disable_plaintext_auth = no info_log_path = /var/log/state.mail/dovecot.pipe log_path = /var/log/dovecot/dovecot.log mail_debug = yes mail_gid = users mail_location = maildir:~/.maildir mail_plugins = acl quota mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/data/home/vmail/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:/data/home/%%n/.maildir:INDEX=~/.maildir/shared/%%u prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Cestino { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox "Posta inviata" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot-dict/shared-mailboxes quota = maildir:User quota quota_rule = *:storage=5M quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore sieve = ~/.dovecot.sieve sieve_before = /var/etc/dovecot/sieve/general/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/dovecot/sieve-execute sieve_filter_bin_dir = /usr/local/bin/dovecot/sieve-filter sieve_global_dir = /var/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.filter +vnd.dovecot.pipe +editheader sieve_pipe_bin_dir = /usr/local/bin/dovecot/sieve-pipe sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = users } } service imap-postlogin { executable = script-login /usr/local/bin/imap-postlogin.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } ssl = no ssl_cert = </conf/etc/cert/certs/services/imap_pop/majornet.crt ssl_key = # hidden, use -P to show it userdb { default_fields = quota_rule=*:bytes=%$ driver = passwd } protocol lda { info_log_path = /var/log/dovecot/dovecot-lda.log log_path = /var/log/dovecot/dovecot-lda.log mail_plugins = acl quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl quota imap_acl imap_quota } I have problems in return extra fields from passwd userdb. My users are partially in passwd files and partially in LDAP. Users who use mail are in LDAP db. If I use "default_fields = quota_rule=*:bytes=100M" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=100M system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=100M doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(afasystems): Debug: Quota grace: root=User quota bytes=10485760 (10%) doveadm(afasystems): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/.maildir doveadm(afasystems): Debug: maildir++: root=/data/home/afasystems/.maildir, index=, indexpvt=, control=, inbox=/data/home/afasystems/.maildir, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 1 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/data/home/vmail/public doveadm(afasystems): Debug: maildir++: root=/data/home/vmail/public, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/data/home/%n/.maildir:INDEX=~/.maildir/shared/%u doveadm(afasystems): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(afasystems): Debug: Namespace : Using permissions from /data/home/afasystems/.maildir: mode=0700 gid=default Quota name Type Value Limit % User quota STORAGE 469 102400 0 User quota MESSAGE 6 - 0 That's ok, but i want to return quota from quotaBytes userdb parameter But if I use "default_fields = quota_rule=*:bytes=%$" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{userdb:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{ldap:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=UNSUPPORTED_VARIABLE_ldap: Invalid bytes limit: UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Error: User init failed Quota name Type Value Limit Where I am wrong? What is the correct configuration? Thanks in advance -- AFA Systems Srl Via G.Pastore Zona Industriale B 86039 Termoli (CB) - Italia tel.: +39 0875 724104 fax.: +39 0875 726084 www.afasystems.it

5 7

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

Steffen Kaiser ha scritto: > Does INBOX/Junk already exists? Yes, (but empty): find /var/vmail/hotelsangiorgioriccione.com/info/ |grep INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/dovecot.index.log /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/dovecot.index.log and same for other v-user "booking" > What's in your ACL file? cat /etc/dovecot/dovecot-acl * user=booking(a)hotelsangiorgioriccione.com lrwsi * user=info(a)hotelsangiorgioriccione.com lrwsi > What does these commands return? > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX is visible in LIST doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX/Junk' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX/Junk is visible in LIST Many thanks Steffen!

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

I add a clarification: Now that I've commented out sieve Junk/Trash on "/etc/dovecot/conf.d/15-mailboxes.conf" > mailbox Junk > { special_use = \Junk > } > mailbox Trash > { special_use = \Trash > } remains a single account with permission issues, only one with write permissions controlled by the ACL plugin: > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > sieve = ~/.dovecot.sieve > sieve_after = /etc/dovecot/sieve-after > sieve_dir = ~/sieve > } Many thanks again!

2 1

Issue on install - file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2)
by Ian Turley 26 Jul '17

26 Jul '17

First of all apologies for using such an old version - I am trying to upgrade slowly and have had to go through this version first. As you can see I am getting an error in the log file as : file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2) Raw backtrace: imap [0x80acdc1] -> imap [0x80accdc] -> imap(mbox_sync+0x14e9) [0x8079a29] -> imap(mbox_storage_sync_init+0x3e) [0x8079d8e] -> imap(imap_sync_nonselected+0x1c) [0x806183c] -> imap(_cmd_select_full+0xc3) [0x8059983] -> imap(cmd_select+0x19) [0x8059b49] -> imap [0x805afb8] -> imap [0x805b03c] -> imap(_client_input+0x6c) [0x805b71c] -> imap(io_loop_handler_run+0x110) [0x80b2a50] -> imap(io_loop_run+0x1c) [0x80b1f8c] -> imap(main+0x4c0) [0x8063640] -> /lib/libc.so.6(__libc_start_main+0xdc) [0xdd4edc] -> imap [0x80561a1] Is this some setting missing or corrupt mailbox? I only have very basic set up at this time to test. Version 1.0.7 # 1.0.7: /etc/dovecot.conf ssl_cert_file: /etc/postfix/certs/emma.turls.co.uk.crt ssl_key_file: /etc/postfix/certs/turls_csr.key login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail/:INBOX=/var/spool/mail mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Regards Ian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> writes: > I have dovecot shielded by fail2ban which works fine. But since a few > days I see many many IPs per day knocking on my doors with wron > password and/or users. But the rate at which they are knocking is very > very low. So fail2ban will never catch them. Slow roll distributed attacks. Really hard to stop. > And I see many many distinct IPs per day (a few hundred) trying many > many existing and non-existings accounts. As you see in the timestamps > in my examples, this can not be handled by fail2ban without affecting > regular users with typos. Is anybody observing something similar ? All the time, and to many services. If you need to be fault tolerant, you'll either have to set tolerant limits (allow reasonable number of failures), or timeout features. You could also track successful logins as whitelisting entries for future logins. > Anybody an idea against this ? Many of these observed IPs are chinese > mobile IPs, if this matters. But we have also chinese students and > researchers all abroad. Nearly an intractable problem, especially since your users are embedded in a notoriously infested network (as someone quipped, "like picking marshmallows out from a pile of sh*t"). Some ideas: - pre-emption (using third party RBLs that targets BFD) - immediate blacklisting of known bad users/passwords (e.g. "admin", "support", extinct users, etc.) - persistent tracking storage: tracking in SQL, or or large LRU list that can reach far enough back in time. (I think Aki mentioned weakforced which you can use instead if fail2ban to implement some of these things.) There are other solutions like alternate ports, port knocking, certificate authentication, or VPN, but they are hard/impossible to do with a large userbase, or have high setup/amortization costs. If you have a enforced strong password policy, these brute forcers have little chance of succeeding, so maybe the easiest cheapest policy is to ignore it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

"mourik jan c heupink" <lists(a)merit.unu.edu> writes: > On 07/24/2017 04:51 AM, Joseph Tam wrote:> You are essentially writing your own backend by taking over >> authentication. You'll be accepting user/password inputs into your >> checkpassword executable, then use the LDAP API (or some other system...snip >> and source address, which will be adversely affect performance on a >> busy server as authentication data cannot be cached. > > While this sounds awesome, it can do much more than what I was/am after, and appears lot more complicated to setup than what I had figured myself. > > Shouldn't I be able to do something like this: > > passdb { > driver = passwd-file > # application specific passwd-file should work from anywhere > # (so: no allow_nets) > args = /etc/dovecot/dovecot-application-specific > } > passdb { > # only allowed to use this from within local 192.168.1.0/24 > args = /etc/dovecot/dovecot-ldap.conf.ext allow_nets=192.168.1.0/24 > driver = ldap > } Yes, that would take care of *one* of the items on your wishlist (network specific passwords). You also wanted time specific passwords. And intelligent brute force detection. And blacklist lookups. Rather than cobbling together fail2ban, utility scripts, multiple passdbs, firewall rules and whatever other system you'll need to recruit, I'm suggesting you amortize the effort and pack it into one place, then you can extend this to incorporate whatever your heart desires. The complexity of implementing this reflects the complexity of your requirements. If you only had generic authentication needs, then the dovecot supplied facilities would be perfect. But you don't. > Where I would generate lines in dovecot-application-specific using a > script or some webpage, and generate lines like: > > username1:randomONE:vmail:vmail::/var/vmail/username1: > username1:randomTWO:vmail:vmail::/var/vmail/username1: > username2:randomTHREE:vmail:vmail::/var/vmail/username2: > username2:randomFOUR:vmail:vmail::/var/vmail/username2: > > And the result would be: username1 can login from anywhere, using > passwords "randomONE" & "randomTWO", plus the password in ldap when > coming from the internal network. You'll probably need 3 passdb, LDAP and 2 fallback passwd-file dbs. Joseph Tam <jtam.home(a)gmail.com>

1 0

SIEVE: handling of lineending in fields
by Ingo Thierack 25 Jul '17

25 Jul '17

Hello, migrated von the mailserver from centos to alpine linux. Most parts are run well. dovecot 2.2.31 sieve: 0.4.19 But i fight with on behavior. I have an sieve script which pipes a few fields to an external script which send this data to an telegram-bot. the part of the sieve-script. if header :matches "Subject" "*" { set "subject" "${1}"; } if header :matches "from" "*" { set "from" "${1}"; } if header :matches "to" "*" { set "to" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 30 "msgcontent"; break; } } pipe :copy :try "notify.sh" [ "", "(${from})#${to}#${subject}", "\"${msgcontent}\"" ]; What i get now is an error about looks like encoding of the linefeeds. default: line 107: error: specified :args item `"test 4??"' is invalid. Here is sent a mail which contains in subject "test 4". or default: line 107: error: specified :args item `"?? ?? ??? ??? Oracle Magazine "' is invalid. Here is sent a mail which contains in subject "test 4". On centos this was never an problem. With alpine-linux this process is complete broken. Any hints, where to look and maybee fix thie behavior? Mybe its ab problem with the libmusl which used in alpine. Regards Ingo

2 2

last_logon SQL mapping
by viper 25 Jul '17

25 Jul '17

Hi I have been attempting to do a mapping on the last_logon plugin. I have been reading the documentation on mapping. is there any way to customise a little more and create a individual SQL query for each of the functions SELECT and UPDATE, my current SQL setup has the username and domain in separate tables and my user_query and password_query are concat which I do not believe can be defined in the dictionary map process, I was also wanting to use datatime as the saved field but it seems only the unix timestamp is used. If there is any way to create a fully custom query that can be executed I believe this would allow me to preform the action am looking for in the same manner as the user_query and password_query If anyone has any suggestions please let me know Regards Craig

2 1

Core dumped when authenticating to managesieve
by Kristjan Eentsalu 25 Jul '17

25 Jul '17

Hey, I'm getting "Error in MANAGESIEVE command received by server." and service(managesieve-login) killed with signal 11 (core dumped) when doing two line autenticate(sogo) to managesieve(). # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" {52+} XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== NO "Error in MANAGESIEVE command received by server." AUTHENTICATE "PLAIN" {52+} <---- trying again Connection closed by foreign host. and after that in logs there is "dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 38748 killed with signal 11 (core dumped)" One line autenticate works. # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==" OK "Logged in." OS: FreeBSD 11.1-RC3 Dovecot 2.2.31 , pigeonhole 0.4.19 Trace below GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)... warning: core file may not match specified executable file. Core was generated by `dovecot/managesieve-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/dovecot/libdovecot-login.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot-login.so.0 Reading symbols from /usr/lib/libssl.so.8...done. Loaded symbols for /usr/lib/libssl.so.8 Reading symbols from /lib/libcrypto.so.8...done. Loaded symbols for /lib/libcrypto.so.8 Reading symbols from /usr/local/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot.so.0 Reading symbols from /usr/lib/libkrb5.so.11...done. Loaded symbols for /usr/lib/libkrb5.so.11 Reading symbols from /usr/lib/libgssapi.so.10...done. Loaded symbols for /usr/lib/libgssapi.so.10 Reading symbols from /usr/lib/libgssapi_krb5.so.10...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.10 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/lib/libasn1.so.11...done. Loaded symbols for /usr/lib/libasn1.so.11 Reading symbols from /usr/lib/libcom_err.so.5...done. Loaded symbols for /usr/lib/libcom_err.so.5 Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/lib/libhx509.so.11...done. Loaded symbols for /usr/lib/libhx509.so.11 Reading symbols from /usr/lib/libroken.so.11...done. Loaded symbols for /usr/lib/libroken.so.11 Reading symbols from /usr/lib/libwind.so.11...done. Loaded symbols for /usr/lib/libwind.so.11 Reading symbols from /usr/lib/libheimbase.so.11...done. Loaded symbols for /usr/lib/libheimbase.so.11 Reading symbols from /usr/lib/libprivateheimipcc.so.11...done. Loaded symbols for /usr/lib/libprivateheimipcc.so.11 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 296 istream.c: No such file or directory. in istream.c (gdb) bt full #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 _stream = (struct istream_private *) 0x5385e16 #1 0x000000000536937a in i_stream_limit_read (stream=0x767d540) at istream-limit.c:34 lstream = (struct limit_istream *) 0x767d540 left = 123848760 ret = 1 pos = 119265200 #2 0x000000000535f340 in i_stream_read (stream=0x767d5b0) at istream.c:174 _stream = (struct istream_private *) 0x767d540 old_size = 0 ret = 124244864 #3 0x00000000053607ae in i_stream_read_data (stream=0x767d5b0, data_r=0x7fffffffe868, size_r=0x7fffffffe878, threshold=0) at istream.c:569 ret = 0 read_more = false #4 0x00000000004038d1 in ?? () No symbol table info available. #5 0x0000000000403c1a in ?? () No symbol table info available. #6 0x00000000004030ad in ?? () No symbol table info available. #7 0x0000000000402eaa in ?? () No symbol table info available. #8 0x0000000004838435 in client_input (client=0x76c0c10) at client-common.c:920 No locals. #9 0x000000000537028d in io_loop_call_io (io=0x76a4300) at ioloop.c:599 ioloop = (struct ioloop *) 0x763a000 t_id = 2 #10 0x0000000005372f74 in io_loop_handler_run_internal (ioloop=0x763a000) at ioloop-poll.c:209 ctx = (struct ioloop_handler_context *) 0x76340e0 pollfd = (struct pollfd *) 0x7673840 tv = {tv_sec = 0, tv_usec = 895835} io = (struct io_file *) 0x76a4300 msecs = 896 ret = 0 call = true #11 0x00000000053707f8 in io_loop_handler_run (ioloop=0x763a000) at ioloop.c:648 No locals. #12 0x0000000005370621 in io_loop_run (ioloop=0x763a000) at ioloop.c:623 No locals. #13 0x00000000052ad15b in master_service_run (service=0x7635000, callback=0x4840630 <client_connected>) at master-service.c:666 No locals. #14 0x00000000048402f7 in login_binary_run (binary=0x4061b8, argc=1, argv=0x7fffffffeb40) at main.c:506 service_flags = 1608 set_pool = 0x7646020 login_socket = 0x48494c6 "login" c = -1 #15 0x000000000040288f in ?? () No symbol table info available. #16 0x000000000462c000 in ?? () No symbol table info available. #17 0x0000000000000000 in ?? () No symbol table info available. Current language: auto; currently minimal dovecot -n # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-RC3 amd64 auth_master_user_separator = * auth_verbose_passwords = plain disable_plaintext_auth = no lmtp_save_to_detail_mailbox = yes mail_access_groups = imapmail mail_debug = yes mail_gid = imapmail mail_plugins = acl quota mail_uid = imapmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace { hidden = no inbox = no list = no location = prefix = separator = / subscriptions = yes type = private } namespace public { hidden = no list = children location = maildir:/mail/imap/ localnet.net/shared:INDEXPVT=%h/public:LAYOUT=fs:DIRNAME=DlkfdewDSD prefix = shared/ separator = / subscriptions = no type = public } namespace inbox { alias_for = hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } namespace user { list = children location = maildir:%%h/Maildir:LAYOUT=fs:DIRNAME=DlkfdewDSD:INDEXPVT=%h/shared/%%n prefix = user/%%n/ separator = / subscriptions = no type = shared } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/mail/dovecot/db/global-acls:cache_secs=300 acl_shared_dict = file:/mail/dovecot/db/shared-mailboxes quota = maildir:INBOX user/%u quota2 = maildir:Public quota:ns=shared/ quota2_rule = *:storage=100G quota_grace = 10%% quota_rule = *:storage=5G quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +editheader } protocols = imap lmtp sieve service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { chroot = drop_priv_before_exec = yes inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 0 vsz_limit = 64 M } ssl = no ssl_cert = </etc/ssl/servercerts/cert.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl quota sieve postmaster_address = postmaster(a)localnet.net } protocol imap { mail_plugins = acl quota imap_acl imap_quota }

3 2

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 25 Jul '17

25 Jul '17

> For more clarity I also attach the content of > "/etc/dovecot/conf.d/15-mailboxes.conf" > > > # mailbox Junk { > # special_use = \Junk > # } > # mailbox Trash { > # special_use = \Trash > # } > mailbox INBOX/Junk { > auto = subscribe > special_use = \Junk > } > mailbox INBOX/Trash { > auto = subscribe > special_use = \Trash > } > > Date: Mon, 24 Jul 2017 18:06:29 +0200 > From: Christian Kivalo <ml+dovecot(a)valo.at> > > Please also provide your doveconf -n Here my Dovecot configuration (I've commented out "mailbox Junk" and "mailbox Trash" above) # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.5 ext4 auth_mechanisms = plain login cram-md5 mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/server.sio4.org/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/server.sio4.org/privkey.pem ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n driver = static } protocol imap { mail_plugins = acl imap_acl mail_log notify } protocol lmtp { mail_plugins = acl sieve } Many thanks Christian!

1 0

Strange Error: Password data is not valid for scheme SHA256. Please help me resolve it.
by david.madman2＠vfemail.net 24 Jul '17

24 Jul '17

Hello, I am using version 2.2.31 (65cde28) on an Ubuntu 16.04 VPS. I am attempting to setup a mail server using a flat file system as an experiment. I am able to send e-mail from external domain names and the messages land in my /var/mail/vmail/domain/user/ directories. I am trying to setup Thunderbird as an MUA using the information I generated on my VPS namely the IMAP server, username(a)domain.com, password, and SMTP server. IMAP server - www.domain.com SMTP server - www.domain.com Username - created in /etc/postfix/virtual-mailbox-users.db and /etc/dovecot/passwd.db Password - created by dovadm pw -s SHA256 and entered (along with the username) in /etc/dovecot/passwd.db I enter this information into "new accounts" in Thunderbird and select STARTTLS with ports 143 (IMAP) and 587 (SMTP). (I have experimented with a variety of other combinations too). I click "Done" which transmits the information to the domain server to verify the details. My /var/log/mail.log shows: Jul 22 18:40:48 www dovecot: auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<wZoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32) Jul 22 18:41:00 www dovecot: message repeated 2 times: [ auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<fGoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)] Jul 22 18:41:02 www dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<test(a)domain.com>, method=PLAIN, rip=46.xxx.xxx.xxx, lip=139.xxx.xxx.xxx, TLS, session=<fGoHUuxU6IAu9j4y> What does "Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)]" mean? I assume that there is some kind of a mismatch between the way I generated the password with doveadm and entered it in passwd.db and the way I entered the non-hashed password into the password field in the new account section of Thunderbird. Is there a way to resolve this issue? My dovecot -n is below. You will note that the passdb section does have the scheme as SHA256. Many thanks. # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-83-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = plain login auth_verbose = yes mail_home = /var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=SHA256 /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/letsencrypt/live/www.domain.com/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it userdb { args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n driver = static } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster(a)domain.com quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

2 4

Re: under some kind of attack
by Joseph Tam 24 Jul '17

24 Jul '17

>> As per my post: checkpassword. You can then use one password on Mondays, >> Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday >> fetched from a rot-13 database, and only from prime numbered IP addresses >> on weekends, if that's what you want. > > Having read the wiki page on checkpassword, I am unsure how this would > work with an ldap backend. > > Could you elaborate on that? You are essentially writing your own backend by taking over authentication. You'll be accepting user/password inputs into your checkpassword executable, then use the LDAP API (or some other system that will do it for you) to authenticate. (You can Google around for code snippets.) You'll have direct control over all aspects of authentication (if/when/where/etc) that a generic backend can't provide. You can choose do implement using shell/PERL/etc script, or compile to executable from C sources. It's more work, but if you need to do everything on your wish list, I can't see any eaiser option. One of the drawbacks is that a working password depends on both time and source address, which will be adversely affect performance on a busy server as authentication data cannot be cached. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

For more clarity I also attach the content of "/etc/dovecot/conf.d/15-mailboxes.conf" # mailbox Junk { # special_use = \Junk # } # mailbox Trash { # special_use = \Trash # } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } Thanks again

2 1

failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

Hello to everyone, On Debian Jessie (no SElinux) and "dovecot-sieve 1:2.2.13-12~deb8u1" I've changed the sieve (sieve_after) Junk and Trash path, from: "INBOX.Junk" to "INBOX/Junk" compiled it: sievec /etc/dovecot/sieve-after/spam-to-folder.sieve but now if i look into mail.err log, found this: Jul 24 07:22:01 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: msgid=<887291195.6699.1500873334921.JavaMail.trend@backend-prod-003>: failed to store into mailbox 'INBOX/Junk': Permission denied Jul 24 07:22:02 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: execution of script /etc/dovecot/sieve-after/spam-to-folder.sieve failed, but implicit keep was successful and many others.. This is the "spam-to-folder.sieve content": require ["fileinto","mailbox"]; if header :contains "X-Spam-Flag" "YES" { fileinto :create "INBOX/Junk"; stop; } where I'm wrong? many thanks!

1 0

dovecot/pigeonhole and sogo
by Thomas Robers 24 Jul '17

24 Jul '17

Hello, I have two systems one with dovecot 2.2.31/Pigeonhole 0.4.19 selfcompiled through the src.rpms from ghettoforge on a CentOS 6.9 server and a second system of SOGo (3.2.9, nightly) on CentOS 7. Everything worked together until I made the update to Dovecot 2.2.31 Pigeonhole 0.4.19. Since then I get an error message when I try to upload a sieve-script. SOGo shows a message popup that "the service is temporarily not available" and in the log file of Dovecot i get: > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<25U/xB5U/KLCw8GK> > Jul 12 15:26:41 mail2 dovecot: auth: Debug: auth client connected (pid=12182) > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<4zxBxB5U/qLCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12263) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<uiR64B5UDKPCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12264) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=1192.168.1.135, TLS: Disconnected, session=<LeJ74B5UDqPCw8GK> Does this mean that managesieve-login doesn't get authentication data from SOGo? SOGo logs for this error: > S[0x7f368f2bab60]: "IMPLEMENTATION" "Dovecot Pigeonhole" > S[0x7f368f2bab60]: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" > S[0x7f368f2bab60]: "NOTIFY" "mailto" > S[0x7f368f2bab60]: "SASL" "PLAIN" > S[0x7f368f2bab60]: "VERSION" "1.0" > S[0x7f368f2bab60]: OK "Dovecot ready." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD > > S[0x7f368f2bab60]: NO "Error in MANAGESIEVE command received by server." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD Than I compiled Dovecot 2.2.31 together with Pigeonhole 0.4.18 and than everything works again as expected. I can upload and activate sieve-scripts from the SOGo webinterface. After that I tried to disable TLS for sieve with ssl = no in the 20-managesieve.conf: [...] protocol sieve { ssl = no [...] to capture the traffic between SOGo and Dovecot/Pigeonhole but then the managesieve-login process crashes: > Jul 12 16:28:32 mail2 dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 12941 killed with signal 11 (core dumps disabled) [last ip=192.168.1.138] Why isn't it possible to disable TLS for sieve and what changes between Pigeonhole 0.4.19 and 0.4.18 could be responsible for the disharmony between SOGo and Pigeonhole. I looked for 'changes' but could not find any hints regarding this problem. Is there a chance to get both work together again? And is it possible to disable TLS for sieve or why crashes the managesieve-login daemon? Any help would be welcome. TIA Thomas Robers

2 2

Modify stored mail contents?
by Evan Martin 23 Jul '17

23 Jul '17

Is there a safe way to modify the contents of emails stored by Dovecot? I'll probably only want to change the message bodies, not the headers, if that matters. Looking for ways to do this both for existing emails and new emails as they are received (though anything that works for existing emails can probably just be run again for new emails.) My mail storage is currently mdbox, but I could migrate to another format if that helps.

5 8

10-ssl ssl = no but dovecot still reads certs
by lists＠lazygranch.com 22 Jul '17

22 Jul '17

I'm bringing up a new email server starting without TLS initially. In 10-ssl.conf I set ssl = no, but the default ssl_cert and ssl_key lines are not commented out. I got the obvious error message: ------------------------------ doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 12: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot -------------------------- No big deal, but I don't remember this being an issue the last time I set up a server. You would think if ssl=no, the ssl_cert and ssl_key files would not be opened.

3 2

Re: under some kind of attack
by Joseph Tam 22 Jul '17

22 Jul '17

mj <lists(a)merit.unu.edu> wrote: > - for external users, to ONLY be allowed to use an application specific > password. (or username and password, fine as well) > > Step one: making ldap password authentication valid only from our > internal network. I though: using allow_nets=192.168.1.0/24 for that passdb > > But I can't get that to work. :-( Unsure where exactly to define the > allow_nets, tried many variations on the theme already. > > Perhaps someone can help with the step one, and also tell me if the > approach outlined above is smart, valid and do-able in dovecot. As per my post: checkpassword. You can then use one password on Mondays, Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday fetched from a rot-13 database, and only from prime numbered IP addresses on weekends, if that's what you want. Gary Sellani <lists(a)lazygranch.com> writes: > Not applicable to most installations, but I use geographical filtering > on all ports other than 25. Fine if you are the only user of the email > system. If you're the only user, moving the IMAP/POP service to a nonstandard port will do most of that with much less bother, and you won't lock yourself out, requiring a ssh/edit firewall/reconnect. Been there, done that. > I get one hacker a week trying to guess passwords, and always from Digital Ocean VPS. abuse(a)digitalocean.com is fairly responsive. They usually nuke them pretty quickly. > I would like to see statistics on the success of such brute force > attacks. They can't be very successful these days. Even if the success rate is 0.00001%, you can do the arithmetic to see that's still a huge number of accounts. But you're right, if you have anything resembling a sensible password policy, they're just a log bloating nuisance. Joseph Tam <jtam.home(a)gmail.com>

2 1

FTS error Unknown user
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, sorry for previous message, i accidentaly send it before it was complete. Recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error everytime a email is received (and FTS is not working, of course): dovecot: indexer-worker: Error: User [censored] lookup failed: Unknown user I don't fully understand why FTS needs to do any user lookup during indexing but, anyway, how can i workaround it? This is relevant config: passdb { driver = static args = password=[censored] allow_nets=[censored] } userdb { driver = static args = home=/var/mail/vhosts/%d/%n/home master_user=%u } plugin { fts = solr fts_solr = url=http://[censored]:8080/solr/ fts_autoindex = yes fts_autoindex_max_recent_msgs = 1000 } FTS is fully configured and working on proxy side (which is, currently, also a backend for most of the users - i will split it in stages, just wanted to say that i have FTS already working). azur

1 1

FTS
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error after every email is received:

1 0

Problem compiling dovecot 2.2.31 on Solaris
by Luciano Mannucci 21 Jul '17

21 Jul '17

I'm trying to compile under SunOS 5.8 Generic_117350-28 sun4u sparc SUNW,Ultra-5_10 (I know it's a bit oldish :-) and I get this error: /bin/bash ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c -o pkcs5.lo pkcs5.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c pkcs5.c -fPIC -DPIC -o .libs/pkcs5.o pkcs5.c:9:20: error: stdint.h: No such file or directory make[4]: *** [pkcs5.lo] Error 1 What have I missed? I did: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var\ --mandir=/usr/share/man --docdir=/usr/share/doc/packages/dovecot\ --disable-ipv6 --enable-header-install\ make Is it reasonable? Thanks in advance, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 6

under some kind of attack
by mj 21 Jul '17

21 Jul '17

Hi all, It seems we are under some kind of password guessing attack: > Jul 18 21:33:33 auth: Info: ldap(username1,103.6.223.61,<W7wLl5xUfABnBt89>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:34:16 auth: Info: ldap(username1,221.4.61.180,<89WnmZxUrADdBD20>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:36:13 auth: Info: ldap(username2,117.243.180.225,<ESWBoJxUdQB187Th>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:50 auth: Info: ldap(username2,58.59.103.230,<j7fQopxUNgA6O2fm>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:56 auth: Info: ldap(username4,58.215.13.154,<gtY5o5xUlQA61w2a>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:18 auth: Info: ldap(username3,220.175.154.205,<lFxppJxUFADcr5rN>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:25 auth: Info: ldap(username5,14.142.29.142,<40zopJxUSgAOjh2O>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:27 auth: Info: ldap(username4,119.1.98.121,<JDQOpZxUCwB3AWJ5>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:54 auth: Info: ldap(username3,218.76.156.11,<OMqtppxUMADaTJwL>): invalid credentials (given password: 1q2w3e4r) Different IPs, different usernames, but all (almost) the same password. Any idea what we can do about this?? Any advice you could give us would be very much appreciated. MJ

7 18

application specific passwords
by mj 21 Jul '17

21 Jul '17

Hi, Further to the other thread about password guessing activities against our dovecot, I would like to implement application specific passwords on our dovecot. Googling results in some documents, but they are all a bit older: > https://www.happyassassin.net/2014/08/26/adding-application-specific-passwo… > https://www.dgsiegel.net/news/2013_05_21-application_specific_passwords_for… > http://www.justinbuchanan.com/blog/category/RoundCube > http://www.justinbuchanan.com/blog/post/2012/12/02/Application-Specific-Pas… Those articles are interesting, but also rather old. (I realse that this does not neccesarily mean: irrelevant or bad) Is there anone here with some additional notes, ideas, tips, trics on setting up application specific passwords with dovecot with virtual users? We are using samba AD as an authentication backend. MJ

3 5

Re: under some kind of attack
by Joseph Tam 21 Jul '17

21 Jul '17

> I would like to create a fail2ban filer, that scans for these lines: > >> Jul 20 11:10:09 auth: Info: ldap(user1,60.166.35.162,<cDFXHbxUQgA8piOi>): invalid credentials (given password: password) >> Jul 20 11:10:19 auth: Info: ldap(user2,61.53.66.4,<V+nyHbxU+wA9NUIE>): invalid credentials (given password: password) > > (as you can see, I have enabled auth_verbose_passwords to do this, > making me very uncomfortable...) > > Anyway: since there are only a few password variations, I would like to > block anyone using those passwords. With all the constraints and processing, I'll offer yet another option: use the checkpassword password authentication scheme. This will bypass post-authentcation log-sniffing and allow you direct access to username, password and client IP (the last I'm not positive about) at authentication time. Now you'll have everything you need to do any wild and crazy auth processing, including database searches and triggering firewall blocking based on whatever crietria you want (including common password use). As to how to integrate it into your dovecot, I'm not sure whether it's best to supplant the LDAP method and authenticate within the checkpassword script, or to put it as the first authentication method (ahead of LDAP) to get first crack at inspect at authentication data, or the fallback authentication method (after LDAP) to pick up all the failures. However, after running honeypots, I can tell you that although BFD attackers will common use passwords, any static list of abused passwords will miss a lot. (A common one they use is $password=variations($user) or variation($domain)). Number of auth failure limits should also be a criteria for banning. Extinct users are also good candidates for instant banning. Joseph Tam <jtam.home(a)gmail.com>

2 1

2.2.devel (0bee280) crashdump virtual plugin
by Thomas Leuxner 20 Jul '17

20 Jul '17

#0 0x00007f497ecdb067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 10092 selftid = 10092 #1 0x00007f497ecdc448 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0xfffe, sa_sigaction = 0xfffe}, sa_mask = {__val = {1024, 140722499998576, 94791001010256, 513, 139953641023651, 140722499998368, 94791001010256, 513, 11573297580199803136, 139953644744448, 139953641204307, 94791001010256, 140722499998464, 0, 139953641204665, 94791001010256}}, sa_flags = 2131669786, sa_restorer = 0x7ffc829fd301} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f497f0f05b6 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 backtrace = 0x56363ff17088 "/usr/lib/dovecot/libdovecot.so.0(+0x9f5be) [0x7f497f0f05be] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f6ac) [0x7f497f0f06ac] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f497f080fde] -> /usr/lib/d"... #3 0x00007f497f0f06ac in i_internal_fatal_handler (ctx=0x7ffc829fd350, format=<optimized out>, args=<optimized out>) at failures.c:670 status = 0 #4 0x00007f497f080fde in i_panic (format=format@entry=0x7f497f47af00 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffc829fd450, reg_save_area = 0x7ffc829fd390}} #5 0x00007f497f3cb6dc in mailbox_notify_changes_stop (box=<optimized out>) at mail-storage.c:1950 __FUNCTION__ = "mailbox_notify_changes_stop" #6 0x00007f497dc5aa6f in virtual_notify_changes (box=0x5636400cdbd8) at virtual-storage.c:696 bboxp_end = 0x563640015708 mbox = 0x5636400cdbd8 bboxp = 0x563640015180 #7 0x000056363f5e2652 in idle_finish (ctx=ctx@entry=0x56363ff64160, done_ok=<optimized out>, free_cmd=free_cmd@entry=true) at cmd-idle.c:46 client = 0x56363ff39e68 #8 0x000056363f5e2783 in idle_client_handle_input (ctx=ctx@entry=0x56363ff64160, free_cmd=free_cmd@entry=true) at cmd-idle.c:67 line = <optimized out> #9 0x000056363f5e284d in idle_client_input_more (ctx=0x56363ff64160) at cmd-idle.c:100 client = 0x56363ff39e68 #10 idle_client_input (ctx=0x56363ff64160) at cmd-idle.c:107 client = 0x56363ff39e68 #11 0x00007f497f105b22 in io_loop_call_io (io=0x56363ffae400) at ioloop.c:599 ioloop = 0x56363ff1f9b0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #12 0x00007f497f10717a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop-epoll.c:223 ctx = 0x56363ff214d0 io = <optimized out> tv = {tv_sec = 3, tv_usec = 496715} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #13 0x00007f497f105bbc in io_loop_handler_run (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop.c:648 No locals. #14 0x00007f497f105d68 in io_loop_run (ioloop=0x56363ff1f9b0) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #15 0x00007f497f08b6d3 in master_service_run (service=0x56363ff1f850, callback=<optimized out>) at master-service.c:666 No locals. #16 0x000056363f5de1d3 in main (argc=1, argv=0x56363ff1f5e0) at main.c:491 set_roots = {0x56363f8096c0 <imap_setting_parser_info>, 0x7f497f8d5540 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x56363ff17048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x56363f5f92b0 <login_client_connected>, failure_callback = 0x56363f5f8bf0 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x56363f602074 "auth-master" c = <optimized out>

2 13

SRS and vacation message
by Kacper Guzik 20 Jul '17

20 Jul '17

Hi i have similiar problem like here: http://www.iredmail.org/forum/topic11833-iredmail-support-vocation-respone-… email send : from : web123(a)gmail.com to : jacka(a)mail.com vocation sent back from : jacka(a)mail.com to : srs0=hmc8=v7=gmail.com=web123(a)mail.com postsrsd changing return-path from web123(a)gmail.com to srs0=hmc8=v7= gmail.com=web123(a)mail.com this is no problem for me but sieve: Vacation's messages are always addressed to the Return-Path address it is possible some how change this ugly to header to normal? dovecot --version 2.2.29.1 (e0b76e3) # 2.2.29.1 (e0b76e3): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) doveconf: Warning: service auth { client_limit=125000 } is lower than required under max. load (150000) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 60 default_client_limit = 125000 default_process_limit = 25000 dict { quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no listen = * log_path = /var/log/dovecot.log login_trusted_networks = xxx mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_max_userip_connections = 128 mail_plugins = quota zlib expire mail_uid = 2000 maildir_broken_filename_sizes = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict sieve = /home/sieve/%Ld/%Ln/dovecot.sieve sieve_after = /home/sieve/dovecot.sieve sieve_default = /home/sieve/dovecot.sieve sieve_dir = /home/sieve/%Ld/%Ln sieve_global_dir = /home/sieve sieve_global_path = /home/sieve/dovecot.sieve sieve_max_redirects = 25 zlib_save = gz zlib_save_level = 9 } protocols = pop3 imap sieve lmtp service auth { service_count = 0 unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0777 user = vmail } } service imap-login { process_min_avail = 16 service_count = 0 vsz_limit = 64 M } service imap { process_limit = 4096 } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } user = vmail } service pop3-login { process_min_avail = 16 service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = root mode = 0666 user = root } user = root } ssl_ca = </etc/ssl/ca-bundle.crt ssl_cert = </etc/ssl/xxx.crt ssl_key = # hidden, use -P to show it submission_host = xxx userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota mail_log notify zlib } protocol pop3 { mail_plugins = quota zlib expire pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_fsync = optimized mail_plugins = quota sieve zlib postmaster_address = xxx } remote xxx { mail_max_userip_connections = 51200 }

1 0

Dovecot imap
by nlekkas＠gmail.com 20 Jul '17

20 Jul '17

Hello there to all ! Here is the doveconf - a as asked by Aki Tuomi.. Do you see anything wrong..? I would appreciate mush in anyone could help ... # OS: Linux 2.6.32-696.1.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) auth_mechanisms = plain login disable_plaintext_auth = no mail_location = maildir:~/Maildir mail_plugins = " quota" mbox_write_locks = fcntl passdb { driver = pam } plugin { quota = fs:User quota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap pop3 userdb { driver = passwd } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = %08Xu%08Xv }

2 1

Re: under some kind of attack
by Joseph Tam 20 Jul '17

20 Jul '17

mj <lists(a)merit.unu.edu> writes: >>> However, it seems almost all IPs are different, and I don't think I can >>> keep the above settings permanently. >> >> Why not? Limited by firewall rules overload? You could probably use >> a persistent DB, can't you? > > I meant: keep the "block after the first failed attempt" setting. People > need the chance to change their password, so I have increased it to two. A timeout feature is handy here; even though you allow attackers several kicks at the can, it will allow your users to eventually gain control to their accounts again after a suitable penalty period. >> You can also use a third party RBL that specialized in brute forcers like >> blocklist.de. You can also feed back fail2ban data and crowdsource BFD >> data to them. > > Yes, I will look into that now. > ... > > Anyone aware of other blocklists that are worth bocking? Because the > list.blocklist.de/lists/all.txt blocks some, but not anywhere near all. There are other RBLs that overlap with this (like CBL), but they include entries will produce false positives. There was OpenBL but that is defunct. The different lists at blocklist.de have varying efficacy: the ssh and smtp BFD detection are fairly good (they have a 90+% hit rate at my site), but the IMAP/POP BFD detection not as good (maybe 20%). However, if people start feeding IMAP/POP fail2ban data back to blocklist.de, that will get better. > I now know how to block large lists of ips, so if anyone has additional > lists to block? Yeah, all of ChinaNet. May produce false positives. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello there ! Is there anything wrong in the config i have sent earlier ..? __________ Information from ESET Endpoint Antivirus, version of detection engine 15774 (20170719) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Re: under some kind of attack
by Joseph Tam 19 Jul '17

19 Jul '17

On Tue, 18 Jul 2017, dovecot-request(a)dovecot.org wrote: > Thanks for the quick follow-ups! Much appreciated. After posting this, I > immediately started working on fail2ban. And between my initial posting > and now, fail2ban already blocked 114 IPs. > > I have fail2ban with maxretry=1 and bantime=1800 > > However, it seems almost all IPs are different, and I don't think I can > keep the above settings permanently. Why not? Limited by firewall rules overload? You could probably use a persistent DB, can't you? You can also use a third party RBL that specialized in brute forcers like blocklist.de. You can also feed back fail2ban data and crowdsource BFD data to them. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello to all !!! I have some issues with some users that login to the same account through imap from many devices like: mobile,desktop/tablet !!! Issues like: 1. When a new email is arrived is not appearing to all devices... 2. New email is arriving to some other devices after a long period of time ... Generally issues like that .... Does anyone have an idea of how to solve this ..? thanks in advance for your time ... __________ Information from ESET Endpoint Antivirus, version of virus signature database 14893 (20170206) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14911 (20170209) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14939 (20170215) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14964 (20170220) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15008 (20170228) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15037 (20170305) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

4 9

Re: passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

The alias works fine. It's just an auth request. I'll live with it. Sent from my Sprint Samsung Galaxy S8+. -------- Original message --------From: Bill Shirley <bill(a)KnoxvilleChristian.org> Date: 7/18/17 11:24 PM (GMT-06:00) To: dovecot(a)dovecot.org Subject: Re: passwd-file, getting invalid uid 0 Unless your userid is also zero, my guess is that Exim isn't using the alias. This message (to me) says "I can't deliver to 'root' because that userid is zero". On Postfix, you have to run 'newaliases' after changing /etc/aliases. Bill On 7/13/2017 3:42 PM, Larry Rosenman wrote: > Per my earlier post about system and virtual users, I have everything working, but I'm seeing the > following message, and wondering: > 1) does it matter? > 2) is there a way to suppress it? > > I have an Exim /etc/aliases entry that sends root to me. > > Jul 13 14:38:47 thebighonker dovecot: auth-worker(13055): Error: passwd-file /etc/passwd: User root has invalid UID '0' > > doveconf -n: > > # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.19 (e5c7051) > # OS: FreeBSD 11.1-PRERELEASE amd64 > auth_mechanisms = plain login > auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net > default_vsz_limit = 1 G > deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) > doveadm_password = # hidden, use -P to show it > lda_mailbox_autocreate = yes > listen = 192.147.25.65, :: > lmtp_save_to_detail_mailbox = yes > login_access_sockets = tcpwrap > mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes > mail_location = mbox:~/mail:INBOX=~/mail/INBOX > mail_log_prefix = "%s(%u/%p): " > mail_plugins = " fts fts_solr notify stats virtual" > mail_privileged_group = mail > mail_server_admin = mailto:ler@lerctr.org > mail_server_comment = LERCTR Mail Server > mailbox_list_index = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve > namespace archive { > hidden = no > list = no > location = mbox:~/MAIL-ARCHIVE > prefix = ARCHIVE/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox INBOX { > auto = create > } > mailbox SENT { > special_use = \Sent > } > mailbox SPAM { > special_use = \Junk > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > mailbox virtual/Flagged { > special_use = \Flagged > } > mailbox virtual/all { > special_use = \All > } > prefix = > } > namespace virtual { > hidden = no > list = yes > location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY > prefix = Virtual/ > separator = / > } > passdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > passdb { > args = user=%Ln noauthenticate > driver = static > skip = authenticated > } > passdb { > args = failure_show_msg=yes session=yes max_requests=20 > driver = pam > skip = authenticated > } > plugin { > fts = solr > fts_autoindex = yes > fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ > fts_tika = http://localhost:9998/tika/ > imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = SPAM > imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY > imapsieve_mailbox2_from = SPAM > imapsieve_mailbox2_name = * > imapsieve_url = sieve://thebighonker.lerctr.org > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append > mail_log_fields = uid box msgid size from subject vsize flags > recipient_delimiter = + > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute > sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > stats_command_min_time = 1 mins > stats_domain_min_time = 12 hours > stats_ip_min_time = 12 hours > stats_memory_limit = 16 M > stats_refresh = 5s > stats_session_min_time = 15 mins > stats_track_cmds = yes > stats_user_min_time = 1 hours > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener auth-client { > mode = 0666 > } > unix_listener auth-master { > mode = 0666 > } > } > service doveadm { > inet_listener http { > port = 8080 > ssl = yes > } > } > service indexer-worker { > drop_priv_before_exec = yes > } > service lmtp { > inet_listener lmtp { > address = 127.0.0.1 > port = 24 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service stats { > chroot = empty > client_limit = 0 > drop_priv_before_exec = no > executable = stats > extra_groups = > fifo_listener stats-mail { > group = > mode = 0666 > user = > } > fifo_listener stats-user { > group = > mode = 0666 > user = > } > group = > idle_kill = 4294967295 secs > privileged_group = > process_limit = 1 > process_min_avail = 0 > protocol = > service_count = 0 > type = > unix_listener stats { > group = > mode = 0666 > user = > } > user = $default_internal_user > vsz_limit = 18446744073709551615 B > } > service tcpwrap { > unix_listener login/tcpwrap { > group = $default_login_user > mode = 0600 > user = $default_login_user > } > } > ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer > ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > userdb { > args = username_format=%Ln /etc/passwd > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol lda { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol pop3 { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol !doveadm { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags > imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} > imap_metadata = yes > mail_max_userip_connections = 50 > mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" > } >

1 0

passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

Per my earlier post about system and virtual users, I have everything working, but I'm seeing the following message, and wondering: 1) does it matter? 2) is there a way to suppress it? I have an Exim /etc/aliases entry that sends root to me. Jul 13 14:38:47 thebighonker dovecot: auth-worker(13055): Error: passwd-file /etc/passwd: User root has invalid UID '0' doveconf -n: # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-PRERELEASE amd64 auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify stats virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = user=%Ln noauthenticate driver = static skip = authenticated } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam skip = authenticated } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 5s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0666 user = } fifo_listener stats-user { group = mode = 0666 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%Ln /etc/passwd driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify stats virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve imap_stats stats" } -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

3 4

Re: passwd-file, getting invalid uid 0
by Larry Rosenman 19 Jul '17

19 Jul '17

On Tue, Jul 18, 2017 at 3:31 PM, Larry Rosenman <larryrtx(a)gmail.com> wrote: > That didn't change it :( > Jul 18 15:28:14 thebighonker dovecot: auth-worker(77908): Error: > passwd-file /etc/passwd: User root has invalid UID '0' > Jul 18 15:28:14 thebighonker dovecot: auth-worker(77908): Error: > passwd-file /etc/passwd: User toor has invalid UID '0' > > doveconf -n: > lrosenman:~ lrosenman$ ssh tbh.lerctr.org doveconf -n > # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.19 (e5c7051) > # OS: FreeBSD 11.1-PRERELEASE amd64 > auth_mechanisms = plain login > auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org > thejonesonair.com thejonesonair.net > default_vsz_limit = 1 G > deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) > doveadm_password = # hidden, use -P to show it > first_valid_gid = 0 > first_valid_uid = 0 > lda_mailbox_autocreate = yes > listen = 192.147.25.65, :: > lmtp_save_to_detail_mailbox = yes > login_access_sockets = tcpwrap > mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes > mail_location = mbox:~/mail:INBOX=~/mail/INBOX > mail_log_prefix = "%s(%u/%p): " > mail_plugins = " fts fts_solr notify stats virtual" > mail_privileged_group = mail > mail_server_admin = mailto:ler@lerctr.org > mail_server_comment = LERCTR Mail Server > mailbox_list_index = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character > vacation subaddress comparator-i;ascii-numeric relational regex imap4flags > copy include variables body enotify environment mailbox date index ihave > duplicate mime foreverypart extracttext vacation-seconds editheader > mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve > namespace archive { > hidden = no > list = no > location = mbox:~/MAIL-ARCHIVE > prefix = ARCHIVE/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox INBOX { > auto = create > } > mailbox SENT { > special_use = \Sent > } > mailbox SPAM { > special_use = \Junk > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > mailbox virtual/Flagged { > special_use = \Flagged > } > mailbox virtual/all { > special_use = \All > } > prefix = > } > namespace virtual { > hidden = no > list = yes > location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY > prefix = Virtual/ > separator = / > } > passdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > passdb { > args = user=%Ln noauthenticate > driver = static > skip = authenticated > } > passdb { > args = failure_show_msg=yes session=yes max_requests=20 > driver = pam > skip = authenticated > } > plugin { > fts = solr > fts_autoindex = yes > fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ > fts_tika = http://localhost:9998/tika/ > imapsieve_mailbox1_before = file:/usr/local/share/dovecot- > pigeonhole/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = SPAM > imapsieve_mailbox2_before = file:/usr/local/share/dovecot- > pigeonhole/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY > imapsieve_mailbox2_from = SPAM > imapsieve_mailbox2_name = * > imapsieve_url = sieve://thebighonker.lerctr.org > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename flag_change append > mail_log_fields = uid box msgid size from subject vsize flags > recipient_delimiter = + > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_extensions = +editheader +vacation-seconds +mboxmetadata > +servermetadata > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute > sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > stats_command_min_time = 1 mins > stats_domain_min_time = 12 hours > stats_ip_min_time = 12 hours > stats_memory_limit = 16 M > stats_refresh = 5s > stats_session_min_time = 15 mins > stats_track_cmds = yes > stats_user_min_time = 1 hours > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener auth-client { > mode = 0666 > } > unix_listener auth-master { > mode = 0666 > } > } > service doveadm { > inet_listener http { > port = 8080 > ssl = yes > } > } > service indexer-worker { > drop_priv_before_exec = yes > } > service lmtp { > inet_listener lmtp { > address = 127.0.0.1 > port = 24 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service stats { > chroot = empty > client_limit = 0 > drop_priv_before_exec = no > executable = stats > extra_groups = > fifo_listener stats-mail { > group = > mode = 0666 > user = > } > fifo_listener stats-user { > group = > mode = 0666 > user = > } > group = > idle_kill = 4294967295 secs > privileged_group = > process_limit = 1 > process_min_avail = 0 > protocol = > service_count = 0 > type = > unix_listener stats { > group = > mode = 0666 > user = > } > user = $default_internal_user > vsz_limit = 18446744073709551615 B > } > service tcpwrap { > unix_listener login/tcpwrap { > group = $default_login_user > mode = 0600 > user = $default_login_user > } > } > ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer > ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384: > EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256: > EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:! > aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS > ssl_key = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > userdb { > args = username_format=%Ln /etc/passwd > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol lda { > mail_plugins = " fts fts_solr notify stats virtual sieve mail_log" > } > protocol pop3 { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol !doveadm { > mail_plugins = " fts fts_solr notify stats virtual mail_log" > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags > imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} > fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} > del=%{deleted} exp=%{expunged} trash=%{trashed} > imap_metadata = yes > mail_max_userip_connections = 50 > mail_plugins = " fts fts_solr notify stats virtual mail_log imap_sieve > imap_stats stats" > } > lrosenman:~ lrosenman$ >

2 2

observium graphs
by Thomas Reifferscheid 18 Jul '17

18 Jul '17

Hello dovecot list, I'm in the middle of creating a plugin for observium[1] and would like to have it create[2] statistical graphs of my dovecot server [3]. The current state can be found here: https://image.ibb.co/efOO9a/dovecot.png However for visibility purposes it doesnt make sense and have observium plot two data sources with different orders of magnitudes right into one graph. So I'd like to ask for your valuable recommendations as for: - What kind of data should be graphed? Global stats or on a per domain level? - What data types to graph? (e.g. stats, getrusage, io, storage, auth check https://wiki2.dovecot.org/Statistics#line-65 for details) - What values should be combined into a single graph? - How often would you reset stats (cronjob calling doveadm stats reset)? Thanks Thomas [1]: http://www.observium.org/ [2]: http://docs.observium.org/apps/ [3]: http://docs.observium.org/developing/add_app/

3 4

Re: SQLite user database
by Joseph Tam 17 Jul '17

17 Jul '17

Lev <leventelist(a)gmail.com> wrote: > Yes, that was a bit odd. Same password, different hash. Even with > verify tool, there was mismatch. So I decided to go for SHA512, > without encryption. Using user@domain as your ID solved your problem, and this side issue of which hash scheme you're using is probably irrelevant. You misunderstand what {SHA512-CRYPT} does compared with {SHA512}. It is normal to get a different hash with the same password when you regenerate the hash because a different random salt was chosen (the part between the '$6$' and the next '$') -- it used as part of the hash computation. {SHA512} is a straight saltless hash -- the same password maps to the same hash. This makes it prone to dictionary attacks (i.e. pre-generated tables of plaintext/hash values). If you support both schemes, SHA512-CRYPT is much stronger. Joseph Tam <jtam.home(a)gmail.com>

2 1

tagged director -
by Matt Bryant 17 Jul '17

17 Jul '17

Hey, Does anyone know how the new(ish) director tags work in respect to which one is select for a user ?? Is there a query or field returned on userdb lookup to specify the director tag to use ??? rgds Matt

2 1

Dovecot Statistics
by Doug Hardie 16 Jul '17

16 Jul '17

I tried to setup statistics as shown on the Statistics wiki page. I encountered a problem with the mail_plugins for imap. in the protocol imap configuration the wiki shows adding imap_stats to mail_plugins. When I do that, dovecot stops authenticating and throwing error messages: Jul 15 12:47:46 mail dovecot: imap(doug)[10.0.1.251]<osGhcGBUmsgKAAH7>: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib95_imap_stats_plugin.so: Plugin stats must be loaded also (you must set: mail_plugins=$mail_plugins stats) Jul 15 12:47:46 mail dovecot: imap(doug): Error: Internal error occurred. Refer to server log for more information. Changing that line to just add stats to mail_plugins resolves the problem. Hopefully that is an error in the wiki... However, in looking at the stats, I don't ever see any values for any of the auth_ values. They all show zero even though there have been numerous authentications by dovecot and postfix. I also notice that there is a new statistics output about every 3 minutes. It appears that the numbers are only for that 3 minute window. Is there a way to set the statistics so that I can see the last 24 hours, or the previous day? -- Doug

2 1

Post-login script on proxy side
by azurit＠pobox.sk 15 Jul '17

15 Jul '17

Hi, is it possible to run a post-login script on proxy side? When a user is 'proxied' away, the standard post-login script seems to be skipped. I want to update last login datetime but only proxy has access to user database (so i cannot run it on backends). azur

3 8

Re: SQLite user database
by Joseph Tam 15 Jul '17

15 Jul '17

Levente Kovacs writes: > I continuously get user authentication errors. I suspect that the problem is > with a password hashing. I used > > # doveadm pw -s SHA512-CRYPT > Enter new password: > Retype new password: > {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ Looks OK. > I have this at the database: > > sqlite> SELECT * from users; > lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I'm not too hip about SQLite and schemas so I don't know about all the other fields you have and whether you're parsing it correctly. Need doveconf -n to see your SQL query. > I've tried adding this to the database, but still no luck. :-( > {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. How does it relate to the previous hash? Same password but another salt and prepended with {SHA512-CRYPT}? > The other thing I want to avoid is the home directory and UID and GID. Is > there any way for dovecot to use logical, non UNIX users so there's no need to > have a user database and an sqlite database? Yes, you want a virtual user setup. https://wiki.dovecot.org/VirtualUsers You still need a user/password database of some sort unless you're contemtemplating some wild free-for-all access with a single shared password. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Cannot Authenticate user with Kerberos/GSSAPI
by Joseph Tam 15 Jul '17

15 Jul '17

mark(a)ohprs.org > My last message probably contained too much information. This one is more succient. "Succint" may not be the right adjective, because I think this is the third copy I've seen. > Here is the dovecot log when user dsmith attempts to connect to dovecot > from the Tbird client: What I see is ... > Jul 11 19:29:46 imap-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=192.168.0.57, lip=192.168.0.2, TLS, session=<jR0sExNUTADAqAA5> ... a failed authentication with no real mention of Kerberos stuff, followed soon after with SSL/Kerberos yackety-yack, and ... > Jul 11 19:30:18 imap-login: Info: Login: user=<dsmith>, method=GSSAPI, rip=192.168.0.57, lip=192.168.0.2, mpid=3150, TLS, session=<iDUNFRNUUgDAqAA5> ... successful authentication via GSSAPI! From the log files you've shown, you were able to authenticate "dsmith". Your mail reader tells you otherwise? Joseph Tam <jtam.home(a)gmail.com>

1 1

SQLite user database
by Levente Kovacs 14 Jul '17

14 Jul '17

Dear Dovecot users/developers, I installed dovecot, and want to use a sqlite database for users, and passwords. I continuously get user authentication errors. I suspect that the problem is with a password hashing. I used # doveadm pw -s SHA512-CRYPT Enter new password: Retype new password: {SHA512-CRYPT}$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/ to get a password hash. I have this at the database: sqlite> SELECT * from users; lev|logonex.eu|$6$1cCNWIMCTpuqmexO$cCq7nDEga1xza3967nZ.BFZaGWNoYwjnNfSCvZE/jGzYAY1hLWE1iHR1KYaO.mvVE4WVdDSrvPNtfwAUn/yk3/|/home/lev|1001|1001 I've tried adding this to the database, but still no luck. :-( {SHA512-CRYPT}$6$kbUEfz/Mcgpctv/s$uNQGOL/2F01Br.vx0twozVi6v.KJAHZV0OQ7yOFwD9YCloh7UJmeFe7WrgUez9Q5xXdrNOU5q9H8fE3FU2ok9. Could you please help me out what I'm doing wrong? I'm using dovecot version: 2.2.13 The other thing I want to avoid is the home directory and UID and GID. Is there any way for dovecot to use logical, non UNIX users so there's no need to have a user database and an sqlite database? Thank you for your help. Levente

1 0

Can Dovecot replace fetchmail?
by Kenneth Porter 14 Jul '17

14 Jul '17

I'm using fetchmail to grab mail for multiple accounts from an external IMAP server and drop it into local mailboxes via SMTP. It polls the remote server every two minutes. Can Dovecot replace this functionality more elegantly, using IDLE to avoid the polling necessary with fetchmail? I'd like to designate that mail for specific accounts on the external server be moved to specific local mailboxes. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 2