- dovecot - dovecot.org

Re: [Dovecot] dnsbl feature for dovecot
by Joseph Tam 04 Jul '13

04 Jul '13

Professa Dementia writes: > 2) Fail2Ban with rules that seem like they are pretty weak, but trust > me, they work fine and you limit complaints from users. > > a) If you get 3 invalid login attempts within a minute from more than > 1 IP address, block that login for 10 minutes. If you have blocked a > login and another attempt to log in to that account is made then tarpit > that connection. Usually 60 seconds is sufficient. Do not extend the > original block time past the original 10 minutes. > b) If you get 5 invalid login attempts within a minute from the same > IP, block that IP for 5 minutes. This is usually a valid user who > forgot their password, as opposed to a) which is usually a malicious > third party. Looking at my POP3/IMAP logs, users enter wrong passwords all the time, then their mail client keeps trying to re-authenticate, giving the appearance of a slow rolling BFD. For example, I just grabbed this typical sample Jul 2 13:24:48 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:26:03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:26:13 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 9 secs): user=<x> ... Jul 2 13:26:37 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:26:43 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:27:08 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:27:14 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:27:30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:27:36 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Jul 2 13:27:51 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 5 secs): user=<x> ... Brute force attempts are more intense, so I think these rules can be set harder to not risk plunking your users into blacklist hell. Also, some common role account (that don't exist on my system e.g. "admin") will trigger an immediate blacklist here -- an easy way to shortcut the process. > I feel your pain and frustration. I do not believe there is an RBL list > of offending IP's for brute force attacks ... Maybe http://www.blocklist.de/en/index.html I use it for ssh BFD blocking, and it detects 2/3 of the IPs trying to do attempts. On their web page, they also list FTP, Web, and Mail login brute forcers, although I'm not sure whether "Mail" logins means IMAP, POP, SMTP-AUTH, or all of them. You can also integrate this with fail2ban so that not only can you use it to block, but can also contribute to the global detection of brute forcers. Joseph Tam <jtam.home(a)gmail.com>

2 1

[Dovecot] Released Pigeonhole v0.4.1 for Dovecot v2.2.4.
by Stephan Bosch 03 Jul '13

03 Jul '13

Hello Dovecot users, Now that I am not preoccupied anymore, I quickly release a new version of Pigeonhole for Dovecot v2.2. This consists mainly of bug fixes. One new feature is that the Sieve plugin will try to pass temporary failures (e.g. from mail storage) back to LDA/LMTP as much as possible. However, this change turned out a little bigger than I would have liked, so experiment with it a bit before you deploy it in production. Changelog v0.4.1: + Added support for handling temporary failures. These are passed back to LDA/LTMP to produce an appropriate response towards the MTA. - Sieve storage: Removed PATH_MAX limitation for active symlink. This caused problems for GNU/Hurd. - Fixed line endings in X-Sieve headers added by redirect command. - ManageSieve: Fixed '[' ']' stupidity for response codes (only happened before login). - Fixed setting name in example-config/conf.d/20-managesieve.conf. - Sieve extprograms plugin: Fixed interaction between pipe command and remote script service. The output from the script service was never read, causing a broken pipe error at the script service. Apparently, this was broken since the I/O handling for extprograms was last revised. - Fixed assertion failure due to datastack problem in message header composition. The release is available as follows: http://www.rename-it.nl/dovecot/2.2/dovecot-2.2-pigeonhole-0.4.1.tar.gz http://www.rename-it.nl/dovecot/2.2/dovecot-2.2-pigeonhole-0.4.1.tar.gz.sig Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] Creating an authenticated user master user
by Chris Bullock 03 Jul '13

03 Jul '13

dovecot --version 1.1.18 mbox format We are trying to migrate from dovecot to another imap server and need some help migrating the user data to the new server. We have written a perl script to migrate the data but it seems that we need an "authenticated or Master user" in order for the script to access the user mail boxes without the users password. We are using PAM authentication, and root does not have access to the user's mail boxes. Any help would be appreciated. Chris

1 0

[Dovecot] lmtp: Disable Delivered-To header
by Micha Krause 03 Jul '13

03 Jul '13

Hi, using LMTP, is it possible to disable the addition of the Delivered-To header to messages? Micha Krause

4 4

[Dovecot] Who all accessed my dovecot server?
by pvsuja 03 Jul '13

03 Jul '13

Hi, I have set up a mail server with dovecot as IMAP/POP3 server, postfix as MTA and roundcube as web mail client. Other mail clients such as Thunderbird is also being used for mail access. Now as a security policy in our organization, I want to know the IP addresses of the machines from which my mail server was accessed. Is there any monitoring tools to get these details? Regards, Suja -- View this message in context: http://dovecot.2317879.n4.nabble.com/Who-all-accessed-my-dovecot-server-tp4… Sent from the Dovecot mailing list archive at Nabble.com.

3 3

[Dovecot] dovecot corrupted transaction log
by John Fawcett 03 Jul '13

03 Jul '13

Hi I came across this error which happend immedately after a mail delivery to the inbox. Should I look for the problem externally to dovecot (ie. file system, operating system) or within dovecot? I never saw this error before installing 2.2.1, with 2.2.2 I seemed to get even more of them so currently back on 2.2.1 Thanks John Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Error: Corrupted transaction log file /var/vmail/mydomain/myemail(a)mydomain/dovecot.index.log seq 311: file size shrank (1184 < 1304) (sync_offset=1304) Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Error: Index /var/vmail/mydomain/myemail(a)mydomain/dovecot.index: Lost log for seq=310 offset=32816 Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Warning: fscking index file /var/vmail/mydomain/myemail(a)mydomain/dovecot.index Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Error: Index /var/vmail/mydomain/myemail(a)mydomain/dovecot.index: Lost log for seq=310 offset=32816 Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Warning: fscking index file /var/vmail/mydomain/myemail(a)mydomain/dovecot.index Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Error: /var/vmail/mydomain/myemail(a)mydomain/dovecot.index log position went backwards (310,32816 < 311,1304) Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Error: Index /var/vmail/mydomain/myemail(a)mydomain/dovecot.index: Lost log for seq=310 offset=32816 Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Warning: fscking index file /var/vmail/mydomain/myemail(a)mydomain/dovecot.index Jun 11 00:00:05 rosalia dovecot: imap(myemail@mydomain): Disconnected: Internal error occurred. Refer to server log for more information. [2013-06-11 00:00:05] in=5596 out=27722 Jun 11 00:02:11 rosalia dovecot: imap-login: Login: user=<myemail@mydomain>, method=PLAIN, rip=81.174.4.175, lip=80.237.194.64, mpid=5824, TLS, session=<lGC47tPexABRrgSv> Jun 11 00:02:11 rosalia dovecot: imap(myemail@mydomain): Error: Transaction log file /var/vmail/mydomain/myemail(a)mydomain/dovecot.index.log: marked corrupted

2 4

[Dovecot] Dovecot METADATA plugin configuration
by Sergey Sidlyarenko 02 Jul '13

02 Jul '13

Debian Wheezy dovecot 2.2.4 (deb http://xi.rename-it.nl/debian/ stable-auto/dovecot-2.2.patched main) dovecot-metadata-plugin v14 /var/lib/dovecot 777 dovecot:dovecot /var/lib/dovecot/shared-metadata 700 dovecot:dovecot /var/run/dovecot 777 dovecot:dovecot /var/run/divecot/dict 666 mail:dovecot Test1 - create calendar UTF7 mailbox (no errors in dovecot-error.log): [02-Jul-2013 15:47:51 +0400]: [4419] S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Welcome to TU FKP IMAP server. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0001 ID ("name" "Roundcube" "version" "1.0-git" "php" "5.4.4-14+deb7u2" "os" "Linux" "command" "/?_task=calendar&_action=calendar") [02-Jul-2013 15:47:51 +0400]: [4419] S: * ID ("name" "Dovecot") [02-Jul-2013 15:47:51 +0400]: [4419] S: A0001 OK ID completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0002 AUTHENTICATE PLAIN [02-Jul-2013 15:47:51 +0400]: [4419] S: A0002 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE METADATA ANNOTATEMORE] Logged in [02-Jul-2013 15:47:51 +0400]: [4419] C: A0003 CREATE &BCAEMAQxBD4ERwQ4BDk- [02-Jul-2013 15:47:51 +0400]: [4419] S: A0003 OK Create completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0004 SUBSCRIBE &BCAEMAQxBD4ERwQ4BDk- [02-Jul-2013 15:47:51 +0400]: [4419] S: A0004 OK Subscribe completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0005 SETMETADATA &BCAEMAQxBD4ERwQ4BDk- (/shared/vendor/kolab/folder-type event /private/vendor/kolab/folder-type NIL) [02-Jul-2013 15:47:51 +0400]: [4419] S: A0005 NO Mailbox does not exist. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0006 SETMETADATA &BCAEMAQxBD4ERwQ4BDk- (/private/vendor/kolab/folder-type event) [02-Jul-2013 15:47:51 +0400]: [4419] S: A0006 NO Mailbox does not exist. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0007 LIST "" "&BCAEMAQxBD4ERwQ4BDk-/*" [02-Jul-2013 15:47:51 +0400]: [4419] S: A0007 OK List completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0008 DELETE &BCAEMAQxBD4ERwQ4BDk- [02-Jul-2013 15:47:51 +0400]: [4419] S: A0008 OK Delete completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0009 UNSUBSCRIBE &BCAEMAQxBD4ERwQ4BDk- [02-Jul-2013 15:47:51 +0400]: [4419] S: A0009 OK Unsubscribe completed. [02-Jul-2013 15:47:51 +0400]: [4419] C: A0010 LOGOUT [02-Jul-2013 15:47:51 +0400]: [4419] S: * BYE Logging out [02-Jul-2013 15:47:51 +0400]: [4419] S: A0010 OK Logout completed. Test2 - create calendar ASCII mailbox: [02-Jul-2013 15:51:20 +0400]: [2611] S: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Welcome to TU FKP IMAP server. [02-Jul-2013 15:51:20 +0400]: [2611] C: A0001 ID ("name" "Roundcube" "version" "1.0-git" "php" "5.4.4-14+deb7u2" "os" "Linux" "command" "/?_task=calendar&_action=calendar") [02-Jul-2013 15:51:20 +0400]: [2611] S: * ID ("name" "Dovecot") [02-Jul-2013 15:51:20 +0400]: [2611] S: A0001 OK ID completed. [02-Jul-2013 15:51:20 +0400]: [2611] C: A0002 AUTHENTICATE PLAIN [02-Jul-2013 15:51:20 +0400]: [2611] S: A0002 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE METADATA ANNOTATEMORE] Logged in [02-Jul-2013 15:51:20 +0400]: [2611] C: A0003 CREATE Work [02-Jul-2013 15:51:20 +0400]: [2611] S: A0003 OK Create completed. [02-Jul-2013 15:51:20 +0400]: [2611] C: A0004 SUBSCRIBE Work [02-Jul-2013 15:51:20 +0400]: [2611] S: A0004 OK Subscribe completed. [02-Jul-2013 15:51:20 +0400]: [2611] C: A0005 SETMETADATA Work (/shared/vendor/kolab/folder-type event /private/vendor/kolab/folder-type NIL) [02-Jul-2013 15:51:50 +0400]: [2611] S: A0005 NO Setting entry failed. [02-Jul-2013 15:51:50 +0400]: [2611] C: A0006 SETMETADATA Work (/private/vendor/kolab/folder-type event) [02-Jul-2013 15:52:20 +0400]: [2611] S: A0006 NO Setting entry failed. [02-Jul-2013 15:52:20 +0400]: [2611] C: A0007 LIST "" "Work/*" [02-Jul-2013 15:52:20 +0400]: [2611] S: A0007 OK List completed. [02-Jul-2013 15:52:20 +0400]: [2611] C: A0008 DELETE Work [02-Jul-2013 15:52:20 +0400]: [2611] S: A0008 OK Delete completed. [02-Jul-2013 15:52:20 +0400]: [2611] C: A0009 UNSUBSCRIBE Work [02-Jul-2013 15:52:20 +0400]: [2611] S: A0009 OK Unsubscribe completed. [02-Jul-2013 15:52:20 +0400]: [2611] C: A0010 LOGOUT [02-Jul-2013 15:52:20 +0400]: [2611] S: * BYE Logging out [02-Jul-2013 15:52:20 +0400]: [2611] S: A0010 OK Logout completed. root@mail:/var/log/dovecot# cat dovecot-errors.log 2013-07-02 15:51:50 imap(admin(a)tufkp.ru): Error: read(/var/run/dovecot//dict) failed: Timeout after 30 seconds 2013-07-02 15:51:50 imap(admin(a)tufkp.ru): Error: metadata: dict commit failed 2013-07-02 15:52:20 imap(admin(a)tufkp.ru): Error: read(/var/run/dovecot//dict) failed: Timeout after 30 seconds 2013-07-02 15:52:20 imap(admin(a)tufkp.ru): Error: metadata: dict commit failed 2013-07-02 15:53:21 dict: Error: file dict commit: file_dotlock_open(/var/lib/dovecot/shared-metadata/) failed: Resource temporarily unavailable 2013-07-02 15:53:53 dict: Error: file dict commit: file_dotlock_open(/var/lib/dovecot/shared-metadata/) failed: Resource temporarily unavailable root@mail:/etc/dovecot# doveconf # 2.2.4: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.1 ext4 # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 10 secs auth_cache_size = 10 M auth_cache_ttl = 2 mins auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = * auth_mechanisms = plain login auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 4096 base_dir = /var/run/dovecot/ config_cache_size = 1 M debug_log_path = default_client_limit = 8192 default_idle_kill = 1 mins default_internal_user = dovecot default_login_user = dovenull default_process_limit = 2048 default_vsz_limit = 2 G deliver_log_format = msgid=%m: %$ dict { expire = pgsql:/etc/dovecot/dovecot-dict-expire.conf metadata = file:/var/lib/dovecot/shared-metadata/ } dict_db_config = director_doveadm_port = 0 director_mail_servers = director_servers = director_user_expire = 15 mins director_username_hash = %u disable_plaintext_auth = yes dotlock_use_excl = yes doveadm_allowed_commands = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_worker_count = 0 dsync_alt_char = _ dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 8 first_valid_uid = 8 hostname = imap_capability = imap_client_workarounds = imap_id_log = imap_id_send = name * imap_idle_notify_interval = 2 mins imap_logout_format = in=%i out=%o imap_max_line_length = 64 k imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imap_urlauth_submit_password = imap_urlauth_submit_user = submission imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ info_log_path = /var/log/dovecot/dovecot.log instance_name = dovecot last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = libexec_dir = /usr/lib/dovecot listen = *, [::] lmtp_address_translate = lmtp_proxy = no lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lock_method = fcntl log_path = /var/log/dovecot/dovecot-errors.log log_timestamp = "%Y-%m-%d %H:%M:%S " login_access_sockets = login_greeting = Welcome to IMAP server. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_trusted_networks = 127.0.0.1 mail_access_groups = mail_always_cache_fields = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = 8 mail_home = mail_location = maildir:/var/mail/%d/%n:LAYOUT=fs:INBOX=/var/mail/%d/%n/maildirfolder:DIRNAME=maildirfolder:INDEX=/var/mail/indexes/%d/%n mail_log_prefix = "%s(%u): " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 1024 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib/dovecot/modules mail_plugins = virtual expire metadata mail_prefetch_count = 0 mail_privileged_group = mail mail_save_crlf = no mail_shared_explicit_inbox = no mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = 8 mailbox_idle_check_interval = 30 secs mailbox_list_index = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = dotlock fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 2 M mmap_disable = no namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = maildir:/var/mail/%d/%n:LAYOUT=fs:INBOX=/var/mail/%d/%n/maildirfolder:DIRNAME=maildirfolder:INDEX=/var/mail/indexes/%d/%n:UTF-8 mailbox Archive { auto = subscribe driver = special_use = \Archive } mailbox Drafts { auto = subscribe driver = special_use = \Drafts } mailbox Junk { auto = subscribe driver = special_use = \Junk } mailbox Sent { auto = subscribe driver = special_use = \Sent } mailbox Trash { auto = subscribe driver = special_use = \Trash } prefix = separator = / subscriptions = yes type = private } namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = virtual:/etc/dovecot/virtual:CONTROL=/var/mail/controls/%d/%n/Вся почта:INDEX=/var/mail/indexes/%d/%n/Вся почта:UTF-8 mailbox { auto = subscribe driver = special_use = \All } prefix = Вся почта/ separator = / subscriptions = no type = private } passdb { args = /etc/dovecot/dovecot-pgsql-master.conf default_fields = deny = no driver = sql master = yes override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } passdb { args = /etc/dovecot/dovecot-pgsql.conf default_fields = deny = no driver = sql master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } plugin { expire = Trash expire2 = Trash/* expire3 = Junk expire_dict = proxy::expire metadata_dict = proxy::metadata sieve = /var/mail/%d/%n/dovecot.sieve sieve_before = /var/lib/dovecot/sieve/ sieve_dir = /var/mail/%d/%n/maildirfolder sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M } pop3_client_workarounds = pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = protocols = imap sieve quota_full_tempfail = no recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 4096 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 2048 process_min_avail = 10 protocol = service_count = 0 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 1 G } service auth { chroot = client_limit = 10240 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = unix_listener auth-client { group = mail mode = 0660 user = mail } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mail mode = 0664 user = mail } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = dovecot vsz_limit = 1 G } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = dovecot mode = 0666 user = mail } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 4096 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = port = 143 ssl = no } inet_listener imaps { address = port = 993 ssl = yes } privileged_group = process_limit = 2048 process_min_avail = 10 protocol = imap service_count = 0 type = login user = dovecot vsz_limit = 1 G } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 4096 drop_priv_before_exec = no executable = imap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 2048 process_min_avail = 10 protocol = imap service_count = 0 type = unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 1 G } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 4096 drop_priv_before_exec = no executable = /usr/lib/dovecot/managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = port = 4190 ssl = no } privileged_group = process_limit = 2048 process_min_avail = 10 protocol = sieve service_count = 0 type = login user = dovecot vsz_limit = 1 G } service managesieve { chroot = client_limit = 4096 drop_priv_before_exec = no executable = /usr/lib/dovecot/managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 2048 process_min_avail = 10 protocol = sieve service_count = 0 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 1 G } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service ssl-params { chroot = client_limit = 0 drop_priv_before_exec = no executable = ssl-params extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = startup unix_listener login/ssl-params { group = mode = 0666 user = } unix_listener ssl-params { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = port = 587 ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service tcpwrap { chroot = client_limit = 1 drop_priv_before_exec = no executable = tcpwrap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_ca = ssl_cert = </etc/ssl/dovecot/example.com.ca.crt ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_crypto_device = ssl_key = </etc/ssl/dovecot/example.com.key ssl_key_password = ssl_parameters_regenerate = 1 hours ssl_protocols = !SSLv2 ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_session_min_time = 15 mins stats_user_min_time = 1 hours submission_host = submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_send_xclient = no submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_user = syslog_facility = mail userdb { args = /etc/dovecot/dovecot-pgsql.conf default_fields = driver = sql override_fields = } valid_chroot_dirs = /var/mail/ verbose_proctitle = yes verbose_ssl = no version_ignore = no protocol imap { mail_max_userip_connections = 1024 mail_plugins = expire virtual metadata imap_metadata imap_annotatemore } protocol lda { hostname = mail.example.com info_log_path = /var/log/dovecot/dovecot-local-deliver.log log_path = /var/log/dovecot/dovecot-local-deliver-errors.log mail_plugins = expire sieve virtual postmaster_address = admin(a)example.com } protocol sieve { managesieve_max_line_length = 65536 }

1 0

[Dovecot] IMAPS: Disable SSL connection without client certificate
by Ireneusz Szcześniak 02 Jul '13

02 Jul '13

I've been using Dovecot 2.1.8 on OpenBSD 5.2 i386 for about a month. It works great. Dovecot serves IMAPS only, and I'm using Thunderbird to access my mail. I configured Dovecot to allow clients that present a valid certificate when establishing SSL connection. I configure my Thunderbird for SSL/TLS connection with normal password. It works fine. However, with my config anybody can connect to my server without presenting a certificate: > openssl s_client -connect server:993 > (...) > * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS > ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. Luckily, after connecting without a certificate logging fails: > a001 login iszczesniak password > a001 NO [ALERT] Client didn't present valid SSL certificate *QUESTION: Is there a way in Dovecot to disable establishing an SSL connection without a client certificate?* My complete config is : # dovecot -n # 2.1.8: /etc/dovecot/dovecot.conf # OS: OpenBSD 5.2 i386 auth_ssl_require_client_cert = yes mail_location = maildir:~/archive/mail mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = bsdauth } protocols = imap service imap-login { inet_listener imap { port = 0 } } ssl_ca = </etc/ssl/certs/cacertcrl.pem ssl_cert = </etc/ssl/cert.pem ssl_key = </etc/ssl/private/key.pem ssl_verify_client_cert = yes userdb { driver = passwd } verbose_ssl = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } -- Ireneusz (Irek) Szczesniak http://www.irkos.org

5 12

[Dovecot] Doubt the relationship between NTLM and Kerberos.
by Maria Jose Yañez Dacosta 01 Jul '13

01 Jul '13

Could someone explain to me what role does the Authenticating Kerberos NTLM in Authenticating NTLM explained in http://wiki.dovecot.org/HowTo/ActiveDirectoryNtlm ? Not understand that relationship between NTLM and Kerberos?. I have to configure thunderbird with simple password method and leave the password to be blank or have to use the gssapi? Although gssapi not supported by windows right? You have to generate a keytab for imap server against AD? I should create in windows and copy it to linux where I have my imap server? I appreciate someone can explain this. Thank you!. -- Maria José

2 1

Re: [Dovecot] Samba4 and user auth
by Pavel Herrmann 01 Jul '13

01 Jul '13

Hi On Monday 01 July 2013 12:36:39 Carsten Laun-De Lellis wrote: > Hi Pavel > > Thankx for your reply. > > When you were setting up your ldap query what kind of password crypto > did you specify plain ntlm gssapi or anything else? The password field > in your query is userPassword or am I wrong here? the password field is hidden (only the user can see it) by default, and not stored as a unix-friendly value (anything a crypt() would understand) what I use is auth_bind (which uses user-supplied password to bind to the LDAP directory). what it means is that on every login there are 2 lookups (first one using your "service" DN to find the user DN, second one with your user DN to check the password) that also means that you need a password format that your LDAP can understand (mostly a plaintext password, or NTLM if your mail server is a Samba domain member). As long as you only offer IMAP/SSL I dont think plaintext (as in "auth_mechanisms = plain") is an issue, security wise. as far as the service account (the one that is used to look up users) goes, I am using the default option (setting "dn" and "dnpass" variables), which I think is a simple bind. it is possible that it only works because Samba4 and dovecot run on the same machine. Pavel Herrmann > > I will try it again. > --- > > Mit freundlichem Gruß > > Carsten Laun-De Lellis > > Hauptstrasse 13 > D-67705 Trippstadt > > Phone: +49 6306 992140 > Fax: +49 6306 992142 > Mobile: +49 151 27530865 > email: carsten.delellis(a)delellis.net > > http://www.linkedin.com/in/carstenlaundelellis [1] > > Am 2013-07-01 11:24, schrieb Pavel Herrmann: > > Hi > > > > On Friday 28 June 2013 07:17:39 Carsten Laun-De Lellis wrote: > >> Hi all I am trying to set up an email Server with a Samba4 AD as user > >> Directory. Does anybody know a good how-to to setup user auth against AD > >> ? Or could anyone tell me how to do it? I am having an email Server up > >> and running with openldap but want to change to Samba4 AD, because of > >> the openchange Integration. I would appreciate any help on this topic.> > > I have an AD/Samba4 auth for dovecot, it works the same as any LDAP would > > (with authenticated lookups and auth_bind) > > > > I would suggest you try it, and ask if there are any issues. > > > > Pavel Herrmann > > Links: > ------ > [1] http://www.linkedin.com/in/carstenlaundelellis

2 1