- dovecot - dovecot.org

Is multi factor authentication practical/feasible?
by Steve Dondley 14 Jul '22

14 Jul '22

I have a small client whose insurance company insists they have MFA for their email to be covered under some kind of data protection policy. Currently I have the client set up on a Debian box for the email server coupled with roundcube for webmail. Most the users just use roundcube but some also use their mobile devices to check email. Maybe one person uses outlook. There’s about 5 to 10 users total. I know roundcube offers a MFA plugin. But I don’t have the foggiest idea how of an iPhone, Android device, or Outlook could all be set up to work with MFA with a standard dovecot/postfix setup. Are there any practical solutions for easily implementing MFA that could work across multiple devices?

13 21

Re: namespace directives from userdb not being applied
by Brendan Braybrook 14 Jul '22

14 Jul '22

On 2022-07-14 11:04, Benny Pedersen wrote: > Brendan Braybrook skrev den 2022-07-14 19:22: > >> login_trusted_networks = 10.200.0.0/16 10.5.0.0/16 10.0.0.0/8 > > this is rendered to one single cidr 10.0.0.0/8 :) > > so 10.200... 10.5.... can be removed without change rules on it oh, yah. i just jammed that in while testing from a new host - the 10.0.0.0/8 cidr block shouldn't really be there (it didn't even help, as the other host was going through NAT to a different ip block)

1 0

Thunderbird / Copy to Send folder times out
by Paul Kudla (SCOM.CA Internet Services Inc.) 14 Jul '22

14 Jul '22

I know this has been asked before in both Dovecot & Thunderbird Forums (i will posting this info there as well) It seems every once in a while that copy to sent folder timeout occurs and you have to hit retry a few time for it to complete I know this is a network issue (ie network speed, congestion etc does cause an issue) That being said is there an imap timeout variable that would addres this issue and or does anyone know about a thunderbird variable I have been unable to locate anything specific to this issue and am aware that we probably need to patch both sides? ideas anyone ?? -- Happy Thursday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

2 1

Having an issue migrating mailboxes with the doveadm backup tool...
by Tom Spettigue 14 Jul '22

14 Jul '22

Hey all. We've got some users that live on our primary email server (which lives in our internal network) that we need to migrate to a second email server (which lives in our DMZ). Both servers serve our domain, example.com, but our first email server runs UW-IMAP, while our newer second server is running dovecot. We need to get these users cleanly migrated over, with all of their emails, and we're trying to do so with the doveadm backup tool - figuring that it will probably "do" Dovecot better than a generic IMAP to IMAP tool. So far, no dice - we get the following error message: Jul 13 16:00:00 doveadm(user(a)example.com): Fatal: All your namespaces have a location setting. Only namespaces with empty location settings are converted. (One namespace should default to mail_location setting) Here is the command I'm trying to run: doveadm -c /etc/dovecot/dovecot-migration.conf -D -o imapc_user=user -o imapc_password=password backup -Ru user(a)example.com imapc: Here is the output of doveconf -n: # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-372.16.1.el8_6.x86_64 x86_64 AlmaLinux release 8.6 (Sky Tiger) # Hostname: example.com auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:~/Maildir passdb { args = /etc/dovecot/passwd driver = passwd-file } postmaster_address = postmaster(a)example.com protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 1.2.3.4 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } user = vmail } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /etc/dovecot/passwd auth_verbose = yes default_fields = uid=vmail gid=vmail home=/var/vmail/%u driver = passwd-file } protocol lmtp { lmtp_rawlog_dir = /tmp/dovecot/%u log_path = /var/log/dovecot-lmtp-debug.log } -- Tom Spettigue Staff Engineer (720) 406-5269 Zonit Structured Solutions www.zonit.com

2 1

Re: Deleting "folders only" folder doesn't actually delete
by Joseph Tam 13 Jul '22

13 Jul '22

> I'm using dovecot-2.3.17.1-1.fc34.x86_64 on fedora34 and Thunderbird 91 on fedora35. When creating a folder of type "folders only" in Thunderbird, then trying to delete it, it doesn't actually delete it from the filesystem. Is this a permissions problem? Or perhaps a Thunderbird problem? Are you using MBOX backend? I think I ran across this problem and it's some confusion as to whether the target is a file or directory. I was finally able to delete it by appending '/' to the name of the folder in my mail reader, but some mail readers do not allow you to type the mailbox name to delete. I believe Tbunderbird has some IMAP server setting that will give it a hint. Joseph Tam <jtam.home(a)gmail.com>

1 0

dsync confusion
by dovecot＠chubb.wattle.id.au 12 Jul '22

12 Jul '22

Hi Folks, The man page for doveadm-sync says that the final argument is the destination to which files will be written. But the example later in the man page says the opposite. Under 'Conversion' I read: ``` Assuming that the mail_location setting in /etc/dovecot/conf.d/10-mail.conf is set to: mail_location = mdbox:~/mdbox, a logged in system user may convert her/his mails from its Maildir in her/his home directory to the mdbox mailbox format. The user has to execute the command: doveadm sync maildir:~/Maildir ``` which has the destination in /etc/dovecot/conf.d and the _source_ as the final argument to doveadm sync. It seems on trying it, that the example doesn't work. To convert from, say mbox to Maildir, I had to do: doveadm backup 'maildir:~/Maildir:LAYOUT=fs' with /etc/dovecot containing mail_location = mbox:~/Mail/:INBOX=/var/mail/%u:INDEX=/var/indices/%u Even this didn't work properly for me. All the messages from all the mboxen in ~/Mail ended up in ~/Maildir/cur and the other mailboxes ended up with empty cur/ and new/ directories under ~/Maildir/xxx/ Dovecot version 2.3.19.1 (9b53102964) installed from Debian sid on x86_64. Home directories are NFS mounted. I don't think the rest of the config is relevant. -- Peter Chubb

3 2

Perl5 error in logs
by ＠lbutlr 11 Jul '22

11 Jul '22

I am getting a lot of these in the logs: dovecot[52816] imap: Error: Use of uninitialized value $ENV{"PATH"} in split at /usr/local/lib/perl5/5.36/mach/File/Spec/Unix.pm line 256. FreeBSD 13.1-RELEASE releng/13.1-n250148-fc952ac2212 GENERIC ===>>> dovecot-2.3.19.1 ===>>> dovecot-pigeonhole-0.5.19 ===>>> perl5-5.36.0 All packages ae up-to-date on the system. Other than the error there doesn’t seem to be any other effect/ Ideas? -- Didn't pay my exorcism bill, got repossessed.

2 2

Trouble configuring managesive plugin for roundcube
by Austin Witmer 10 Jul '22

10 Jul '22

Hello all! I’ve got a bit of a problem that I would like some help with. So, I have two servers, one is my mail server running postfix, dovecot etc. I have a second server setup as my roundcube server. Both servers are running on the same LAN network. I have sieve scripts setup in dovecot in my mail server and they are working great! My trouble is that I can’t seem to make my roundcube talk correctly to managesieve on my mail server. Here is the mail.log file from the mail server when I try to create a sievescript from roundcube webmail: Jul 10 04:11:45 mail dovecot: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=10.116.0.3, lip=10.116.0.2, session=<cZMzomvjyNgKdAAD> And here is my managesieve configuration from my roundcube server. /var/www/roundcube/plugins/managesieve/config.inc.php <?php $config['managesieve_port'] = 4190; $config['managesieve_host'] = 'ssl://10.116.0.2'; $config['managesieve_auth_type'] = null; $config['managesieve_auth_cid'] = null; $config['managesieve_auth_pw'] = null; $config['managesieve_usetls'] = false; $config['managesieve_conn_options'] = array( 'ssl' => array( 'verify_peer' => false, 'allow_self_signed' => true, ), ); $config['managesieve_default'] = 'var/lib/dovecot/sieve/default.sieve'; $config['managesieve_script_name'] = 'default.sieve'; $config['managesieve_mbox_encoding'] = 'UTF-8'; $config['managesieve_replace_delimiter'] = ''; $config['managesieve_disabled_extensions'] = []; $config['managesieve_debug'] = true; $config['managesieve_kolab_master'] = false; $config['managesieve_filename_extension'] = '.sieve'; $config['managesieve_filename_exceptions'] = []; $config['managesieve_domains'] = []; $config['managesieve_default_headers'] = ['Subject', 'From', 'To']; $config['managesieve_vacation'] = 0; $config['managesieve_forward'] = 0; $config['managesieve_vacation_interval'] = 0; $config['managesieve_vacation_addresses_init'] = false; $config['managesieve_vacation_from_init'] = false; $config['managesieve_notify_methods'] = ['mailto']; $config['managesieve_raw_editor'] = true; $config['managesieve_disabled_actions'] = []; $config['managesieve_allowed_hosts'] = null; Does anybody have any clue why roundcube isn’t able to login in to managesieve on my mail server? Are there more logs/configs you would like to see? Thanks in advance for your help and suggestions! Austin Witmer

2 1

CVE-2022-30550: Privilege escalation possible in dovecot when similar master and non-master passdbs are used
by Aki Tuomi 10 Jul '22

10 Jul '22

Affected product: Dovecot IMAP Server Internal reference: DOV-5320 Vulnerability type: Improper Access Control (CWE-284) Vulnerable version: 2.2 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed in main Researcher credits: Julian Brook (julezman) Vendor notification: 2022-05-06 CVE reference: CVE-2022-30550 CVSS: 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vulnerability Details: When two passdb configuration entries exist in Dovecot configuration, which have the same driver and args settings, the incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation with certain configurations involving master user authentication. Dovecot documentation does not advise against the use of passdb definitions which have the same driver and args settings. One such configuration would be where an administrator wishes to use the same pam configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user. Risk: If same passwd file or PAM is used for both normal and master users, it is possible for attacker to become master user. Workaround: Always authenticate master users from different source than regular users, e.g. using a separate passwd file. Alternatively, you can use global ACLs to ensure that only legimate master users have priviledged access. Fix: This has been fixed in main branch. See https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch

5 5

User authentication / activity log
by Karl Denninger 07 Jul '22

07 Jul '22

I'm on 2.3.19.1 (9b53102964) running on FreeBSD, if it matters. I have a set of maintenance "things" that I want to have happen if someone does not authenticate against Dovecot (to check mail) after some period of time. I was running the Z-Push exchange server, which (as its in PHP) made sticking an "you were here" flag in the user's filesystem easy, which of course means checking it is easy since the modification time on the file is sufficient. I was looking for something similar that I could use with Dovecot and my first thought was the cache or index files, but as it turns out local delivery (I'm running Postfix) updates those, so they're not left alone if no client is connected. I also don't see anything appropriate in the syslog that dovecot dumps into there I can scan for on a sign-in. My auth mechanism is "straight" login, no LDAP or similar, and I use pam as the mechanism. I don't see anything in the auth.log file or dovecot's logs. My authentication section for dovecot is pretty-basic: auth_mechanisms = login disable_plaintext_auth = yes passdb { args = session=yes dovecot driver = pam } protocols = imap Does Dovecot maintain something that I can reasonably find in the filesystem for this? A perusal of the documentation doesn't appear to show anything directly pertinent -- but I may have missed it. It appears that the event export capacity might be able to do this but I'm confused on how to set it up; what would be very useful is if, for each user, the log point could be different (e.g. in their home directory) and if it allowed overwriting (thus becoming an activity flag, basically.) Thanks in advance! -- Karl Denninger karl(a)denninger.net /The Market Ticker/ /[S/MIME encrypted email preferred]/

2 2