- dovecot - dovecot.org

[Dovecot] v2.1.16 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz.sig + Added quota-status policy service for Postfix + Added "doveadm batch" command to run multiple commands before moving onto the next user (useful only with -A and -u <usermask>) + Added forwards compatibility for v2.2 index files - mdbox: Index rebuilding crashed in some situations - Fixed a race condition with setting \Recent flags - Fixed a crash when decoding a specific message (decoding is done for SEARCH TEXT/BODY and with full text search indexing, so this couldn't fully DoS a user)

7 24

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > * Andreas Meyer <anmeyer(a)anup.de>: > > > Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. > > Gut. > > > Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) > > Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de > > Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> > > Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] > > Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Na dann sind deine Restrictions falsch und die Mail wird "OK"'ed bevor > der Policy Server gefragt wird. > > > Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 > > ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich > > den check am Ende hatte noch nach postgrey. > > > > smtpd_recipient_restrictions = > > ---> hier einbauen <--- > ist ja nur zum Test > > > check_sender_access hash:/etc/postfix/access_sender, > > permit_mynetworks, > > permit_sasl_authenticated, > > reject_invalid_helo_hostname, > > reject_unlisted_recipient, > > warn_if_reject check_policy_service inet:127.0.0.1:12340 > > reject_unknown_sender_domain, > > check_sender_access pcre:/etc/postfix/umlaute.pcre, > > check_recipient_access pcre:/etc/postfix/umlaute.pcre, > > reject_unauth_destination, > > reject_rbl_client bl.spamcop.net, > > reject_rbl_client zen.spamhaus.org, > > check_client_access cidr:/etc/postfix/client.cidr, > > check_policy_service inet:127.0.0.1:10023 That did the trick! The order of the recipient_restricitons was wrong. Apr 7 20:24:55 delta postfix/smtpd[23806]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:55 delta postfix/smtpd[23806]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:24:56 delta postfix/smtpd[23806]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 552 5.2.2 <miles(a)anup.de>: Recipient address rejected: Quota exceeded (mailbox for user is full); from=<anmeyer(a)anup.de> to=<miles(a)anup.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:24:56 delta postfix/smtpd[23806]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] The MUA does not get rid of the mail, when it would exceed the quota. But now the next problem. I cannot send this mail and get the following with smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:12340 check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, .... Apr 7 20:31:43 delta postfix/smtpd[23820]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:44 delta postfix/smtpd[23820]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:45 delta postfix/smtpd[23820]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:31:46 delta postfix/smtpd[23820]: warning: problem talking to server 127.0.0.1:12340: Success Apr 7 20:31:46 delta postfix/smtpd[23820]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 451 4.3.5 Server configuration problem; from=<anmeyer(a)anup.de> to=<dovecot(a)listen.jpberlin.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:31:46 delta postfix/smtpd[23820]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:46 delta postfix/smtpd[23820]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] the mail is not sent out. I deactivated the check to get sent mail sent. Andreas

1 0

[Dovecot] IDLE and inactivity
by Andreas Meyer 07 Apr '13

07 Apr '13

Good day! Apr 07 10:59:40 imap(anmeyer(a)anup.de): Info: Disconnected: Disconnected in IDLE in=725 out=2546 Apr 07 10:59:59 imap(anmeyer(a)anup.de): Info: Disconnected for inactivity in=952 out=25789 Please someone explain to me the IDLE state and the inactivity state an what the numbers at in= and out= means! Andreas

2 1

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Hallo Waffenmeister! Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > > Apr 7 14:07:52 delta postfix/qmgr[19078]: 1D8921B31260: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 14:07:53 delta postfix/pipe[19091]: 1D8921B31260: to=<miles(a)anup.de>, relay=dovecot, delay=2542, delays=2542/0.01/0/0.29, dsn=4.3.0, status=deferred (temporary failure) > > Ich sehe hier nur einen Fehler vom transport "dovecot". > > > plugin { > > quota = maildir:User quota > > quota_grace = 10%% > > quota_rule = *:storage=500MB > > quota_rule2 = Trash:storage=+10%% > > > > quota_status_success = DUNNO > > quota_status_nouser = DUNNO > > quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll > > Lass mal das quota_status_overquota feld weg. Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Also ich vermisse das reject-warning von postfix und es hat auch nicht den > > Anschein, dass postfix den Status der Quota bei dovecot über port 12340 > > abfrägt. > > Naja, vielleicht steht es an der falschen Stelle in den Restrictions! > Das muss passieren BEVOR irgendwas ein OK zurückgibt. Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich den check am Ende hatte noch nach postgrey. smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_unlisted_recipient, warn_if_reject check_policy_service inet:127.0.0.1:12340 reject_unknown_sender_domain, check_sender_access pcre:/etc/postfix/umlaute.pcre, check_recipient_access pcre:/etc/postfix/umlaute.pcre, reject_unauth_destination, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, check_client_access cidr:/etc/postfix/client.cidr, check_policy_service inet:127.0.0.1:10023 Andreas

1 0

[Dovecot] v2.2.rc5 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz.sig One more API change that required also a Pigeonhole modification. A few other random fixes. I'm planning on making v2.2.0 release on Monday. Please test before that. :)

7 7

Re: [Dovecot] MOSTLY SOLVED: Re: client limit and STARTTLS
by Reindl Harald 07 Apr '13

07 Apr '13

Am 07.04.2013 12:36, schrieb David Benfell: > On 04/07/2013 03:15 AM, Reindl Harald wrote: >> Am 06.04.2013 10:09, schrieb David Benfell: >>> So I changed it again: >>> >>> default_process_limit = 128 default_client_limit = 512 >>> >>> And now it seems to be fine. But I'm mystified because what you >>> say is the case on your system, that is, that the process limit >>> needs to be greater than the client limit, is what I would >>> expect: wouldn't each client require at least one process? > >> no, 512x128 = 65536 connections each process can serve >> default_client_limit clients > > Thanks a million! I had no idea that was how it worked. I would think > that 65536 would be enough. ;-) http://wiki2.dovecot.org/LoginProcess High-performance mode: It works by using a number of long running login processes, each handling a number of connections. This loses much of the security benefits of the login process design, because in case of a security hole (in Dovecot or SSL library) the attacker is now able to see other users logging in and steal their passwords, read their mails, etc. Default client_limit * process_limit = 1000*100 = 100k connections vsz_limit should be increased to avoid out of memory errors, especially if you're using SSL/TLS.

1 0

[Dovecot] The sieve_extprograms plugin included in main Pigeonhole 0.4 source tree
by Stephan Bosch 07 Apr '13

07 Apr '13

Hi, I think the sieve_extprograms is mature enough for an initial release and that is why I've included the sieve_extprograms plugin into the main Pigeonhole v0.4 source tree. It is still a plugin, but is no longer provided as a separate package. This should make things easier. It will be released along with Pigeonhole v0.4.0. Regards, Stephan.

1 0

Re: [Dovecot] script to detect dictionary attacks
by Stephen Davies 07 Apr '13

07 Apr '13

Here is the simplex script that I use to filter attacking sites. I should be easy to add your extra bits (email etc). Cheers, Stephen #! /bin/sh d=`date +"%b %d"` grep "$d" /var/log/mail/info.log|grep ruleset=check_rcp | gawk '{split($0,q,/[\[\]]/);print "/sbin/iptables -A INPUT -s " q[4] "/32 -j DROP"}' | sort -u > /tmp/fw$$ #reset iptable to base /etc/rc.d/rc.fw > /dev/null 2>&1 #add new filter(s) . /tmp/fw$$ rm -f /tmp/fw$$ -- ============================================================================= Stephen Davies Consulting P/L Phone: 08-8177 1595 Adelaide, South Australia. Mobile:040 304 0583 Records & Collections Management.

1 0

[Dovecot] Released Pigeonhole v0.3.4 for Dovecot v2.1.16
by Stephan Bosch 06 Apr '13

06 Apr '13

Hello Dovecot users, Much time passed since I last released a new Pigeonhole, so quite a few unreleased fixes were pending until now. Development of new features is shifted to the upcoming Pigeonhole v0.4 for Dovecot v2.2. I intend to release v0.4.0 shortly after Dovecot v2.2.0. Changelog v0.3.4: * Changed error handling to be less of a nuisance for administrators. Strictly user-caused errors are only reported in user log. Some errors are logged as info instead. * Sieve: Changed behavior of redirect in case of a duplicate message delivery or a mail loop. If a duplicate is detected the implicit keep is canceled, as though the redirect was successful. This prevents getting local deliveries. The original SMTP recipient is used when it is available to augment the entry in the LDA duplicate database. This way, duplicates are only detected when (initially) addressed to the same recipient. + Sieve vnd.dovecot.duplicate extension: added new features to the duplicate test, making it possible to manually compose the key value for duplicate checking. This extension is in the process of being standardized: https://tools.ietf.org/html/draft-bosch-sieve-duplicate-01 + Sieve date extension: generate warning when invalid date part is specified. - Sieve editheader extension: fixed crash occurring when addheader :last was used. - Sieve include extension: fixed missing error cleanup that caused a resource leak. - Sieve vacation extension: fixed determination of From: address for when sieve_vacation_dont_check_recipient is active. - Sieve tools: the -D option wasn't enabled and documented for all tools. - Sieve dict script storage: fixed potential segfault occurring when dict initialization fails. - ManageSieve: fixed bug in skipping of CRLF at end of AUTHENTICATE command. - ManageSieve: fixed handling of unknown commands pre-login. - Fixed compile on Mageia Linux. The release is available as follows: http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.4.tar.gz http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.4.tar.gz.sig Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] password encryption
by Jim Pazarena 06 Apr '13

06 Apr '13

I have just come to the realization that password encryption using the crypt function in linux, ONLY USES THE FIRST 8 CHARS. I have written routines using crypt allowing 16+ chars, and find that anything past 8 is ignored. Wow. Is there a way around this that can be used in dovecot, as well as encryption routines for an email front end? (not system users). It's the integration with dovecot which is the most important.

4 3