- dovecot - dovecot.org

[Dovecot] Attacking Dovecot
by Nikos Papadopoulos 12 Sep '11

12 Sep '11

Hello, I am using Dovecot ver.1.0.7 on an x86 server with RedHat Linux Enterprise 5 and the following configuration: # 1.0.7: /etc/dovecot.conf protocols: pop3 login_dir: /var/run/dovecot/login login_executable: /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail:INBOX=/var/mail/%u mail_executable: /usr/libexec/dovecot/pop3 mail_plugin_dir: /usr/lib/dovecot/pop3 pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: passdb: driver: pam userdb: driver: passwd It seems that my mail server is being attacked by someone who tries to retrieve users' credentials. Please read below an output of logwatch. dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user sandra dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user tanya dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user tanya dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user dark dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user dark dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user gibson dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user frank dovecot-auth: pam_succeed_if(dovecot:auth): error retrieving information about user frank Besides, some of the local users receive "spam" emails, which seem to be sent by another local user. Please assist me on how to prevent the aforementioned attack. Best Regards, Nikos

3 2

[Dovecot] dovecot 2.0.12: mdbox & quota=dirsize
by Роман Захров 12 Sep '11

12 Sep '11

#doveconf -v ...................... quota = dirsize:User quota quota_debug = yes quota_exceeded_message = message quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u ............................ # du --max-depth=1 -h 311M ./storage 20K ./sieve 7,8M ./mailboxes 319M . # doveadm quota get -u myuser Quota name Type Value Limit % User quota STORAGE 7948 399360 2 # then i change ./dovecot-2.0.12/src/plugins/quota/quota-dirsize.c 165-- </span>path = mailbox_list_get_path(namespaces[i]->list, NULL, 166-- MAILBOX_LIST_PATH_TYPE_MAILBOX); 165++ </span>path = mailbox_list_get_path(namespaces[i]->list, NULL, 166++ MAILBOX_LIST_PATH_TYPE_DIR); # doveadm quota get -u myuser Quota name Type Value Limit % User quota STORAGE 325885 399360 81 #

3 2

Re: [Dovecot] Mails repopping
by Simon Brereton 12 Sep '11

12 Sep '11

> -----Original Message----- > From: dovecot-bounces(a)dovecot.org [mailto:dovecot- > bounces(a)dovecot.org] On Behalf Of Simon Brereton > > -----Original Message----- > > From: Timo Sirainen [mailto:tss@iki.fi] On Fri, 2011-09-09 at 13:07 > > -0400, Simon Brereton wrote: > > > > > I have a server that's been running Courier for about 6 years and > > in > > > all that time I think I've only ever had 1 issues where an entire > > mail > > > box was repopped by a webmail client. However, since moving to a > > new > > > server and dovecot 4 weeks ago, I've now had the webmail client > > repop > > > this account 4 times (there are about 230 mails in the account). > > > > > > Is there a setting I need to tighten to prevent/remedy this? I > > have > > > no idea if it's happening on other accounts, but this is one that > I > > > see. The format is maildir. There has been no changes to the > > webmail > > > client. > > > > dovecot -n output would have been nice. Also do you see anything in > > error logs? > > Ah. My apologies of course. Here it is.. > > mail:~# dovecot -n > # 1.2.15: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.2 ext3 I've only just noticed that installing from apt-get on Debian 64-bit installs Dovecot 1.2 - does anyone know when 2.x will be available via apt? Simon

1 0

Re: [Dovecot] Mails repopping
by Timo Sirainen 12 Sep '11

12 Sep '11

On Fri, 2011-09-09 at 13:07 -0400, Simon Brereton wrote: > I have a server that's been running Courier for about 6 years and in > all that time I think I've only ever had 1 issues where an entire mail > box was repopped by a webmail client. However, since moving to a new > server and dovecot 4 weeks ago, I've now had the webmail client repop > this account 4 times (there are about 230 mails in the account). > > Is there a setting I need to tighten to prevent/remedy this? I have > no idea if it's happening on other accounts, but this is one that I > see. The format is maildir. There has been no changes to the webmail > client. dovecot -n output would have been nice. Also do you see anything in error logs? If you're using the default pop3_uidl_format it'll rely on IMAP UIDs to stay the same, and I guess it's possible that due to some other problem they change (that should be logged as an error/warning though). You could try setting pop3_uidl_format=%f, but it will cause everyone to redownload mails. With newer Dovecot versions you could set pop3_save_uidl=yes and when you think everyone's downloaded mails once you can safely change the pop3_uidl_format.

2 1

[Dovecot] Dsync and hidden files
by Dick Middleton 12 Sep '11

12 Sep '11

Hi, I'm in the process of changing from Dovecot v1 to v2 and changing to mdbox in the process. I've come across a little problem which I was hoping there would be a workaround for. There are sieve config files in the home directories which are hidden files. Dsync croaks when it finds one of these because they are not mbox format. It would be nice if they were ignored (or copied unchanged). Is there another way to deal with them other than by deleting thm? Dick

2 2

[Dovecot] problem migrating from maildir to dbox
by Ramón Frontera 12 Sep '11

12 Sep '11

Hello, we want to migrate Mail folders from Maildir to dbox without downtime. We change the mail_location to dbox in 10-mail.conf and restart dovecot. After that we use dsync -u user mirror maildir:~/Maildir. The problem is that if INBOX exists the dsync create a new folder with name like b5893c0a93ff694e551200002dfa3112 Can I migrate to the existing INBOX? or How can I merge the 2 INBOX folders? Thanks for your help! Regards, -- Ramon

3 7

[Dovecot] general advice sought
by Alan Brown 12 Sep '11

12 Sep '11

I'd like to hear the thoughts of list members on which type of storage method seems "best" for inboxes and for folders. The filesystem is GFS2 and for various reasons I can't change it. Inboxes - currently Mbox format. Some users have upwards of 5000 messages in there (the largest is about 18k entries) and thanks to attachments some inboxes are 40-200Mb with a few sitting at 2-3Gb. (Suicidal, I know but enforcing rules is politik-laden and getting academics to behave sensibly is like herding cats) Folders: Mdir format. Thanks to GFS2 filesystem limitations(*) I'm currently enforcing a limit of 4000 messages/folder. It'd be nice to have a "better" way of storing these which doesn't drive up backup loads tremendously. The mail spool has around 6 million files in the folders, covering about 400Gb. GFS2 filesystem limitations are painful. While there are no hard limits, It really doesn't cope well with a lot of files in any given directory thanks to limitations in the way that cluster locking is propagated, There are marked slowdowns about 100 files, this becomes awful above 1000 and effectively unusable above about 8000 entries as the entire IO system gets halted momentarily when such directories are opened and the directory may take up to 5 minutes to return a "ls" result. Some users had upwards of 80k files in their mail folders (~40k messages) and accessing these brought the entire system to a halt. If I migrate to other formats (eg mdbox), then it needs to be able to be done on the fly. (Taking the mailservers down for a day won't go down well, even an hour raises howls). Any suggestions?

2 1

[Dovecot] 2.1: imapc LIST problem / usage question
by Lutz Preßler 12 Sep '11

12 Sep '11

----- Forwarded message from SerNet Support Lutz Preßler <support(a)SerNet.DE> ----- From: SerNet Support Lutz Preßler <support(a)SerNet.DE> Subject: 2.1: imapc LIST problem / usage question To: dovecot(a)dovecot.org Date: Fri, 9 Sep 2011 12:00:46 +0200 Organization: SerNet Service Network GmbH Hello, 2.1.alpha1 (latest Debian auto build on amd64) As a test, namespace for gmail integration set up by userdb with userdb_namespace=gmail userdb_namespace/gmail/list=yes userdb_namespace/gmail/subscriptions=no userdb_namespace/gmail/separator=. userdb_namespace/gmail/prefix=INBOX.gmail. userdb_namespace/gmail/location=imapc: userdb_imapc_host=imap.gmail.com userdb_imapc_user=ixxxxx(a)gmail.com userdb_imapc_password=xxxxx userdb_imapc_ssl=imaps userdb_imapc_ssl_ca_dir=/etc/ssl/certs userdb_imapc_port=993 (but having the namespace set up in config file makes no difference). This works in principle. I can e.g. 0 select "INBOX.gmail.[Gmail].Alle Nachrichten" * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 31 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1] UIDs valid * OK [UIDNEXT 19689] Predicted next UID * OK [NOMODSEQ] No permanent modsequences 0 OK [READ-WRITE] Select completed. and even use the gmail mailboxes within dovecot-virtual files! But: LIST seems broken: 0 list "" "*" * LIST (\HasChildren) "." "INBOX" * LIST (\HasNoChildren) "." "INBOX.privat" * LIST (\HasChildren) "." "INBOX.test" * LIST (\HasNoChildren) "." "INBOX.test.test2" * LIST (\HasNoChildren) "." "INBOX.Trash" * LIST (\HasNoChildren) "." "INBOX.in2009" [...] * LIST (\Noselect \HasChildren) "." "INBOX.gmail" * LIST (\HasNoChildren) "." "Arbeit" * LIST (\HasNoChildren) "." "Belege" * LIST (\HasNoChildren) "." "Privat" * LIST (\HasNoChildren) "." "Reisen" * LIST (\Noselect \HasNoChildren) "." "[Gmail]" * LIST (\HasNoChildren) "." "[Gmail]/Alle Nachrichten" * LIST (\HasNoChildren) "." "[Gmail]/Entw&-APw-rfe" * LIST (\HasNoChildren) "." "[Gmail]/Gesendet" * LIST (\HasNoChildren) "." "[Gmail]/Markiert" * LIST (\HasNoChildren) "." "[Gmail]/Papierkorb" * LIST (\HasNoChildren) "." "[Gmail]/Spam" * LIST (\HasNoChildren) "." "[Gmail]/Wichtig" * LIST (\HasChildren) "." "INBOX.virtual" * LIST (\HasNoChildren) "." "INBOX.virtual.week" * LIST (\HasNoChildren) "." "INBOX.virtual.sent" * LIST (\HasNoChildren) "." "INBOX.virtual.allin" 0 OK List completed. For the Gmail mailboxe the INBOX.gmail prefix is missing and / is used as separator. Second question: Is there a way to include multiple imapc instances/ namespaces with e.g. different destinations servers? I don't see how because imapc_* parameters seem to be global (now), but it would be a very useful feature. Greetings, Lutz

2 5

[Dovecot] Read-only mbox files
by Tim Bishop 12 Sep '11

12 Sep '11

Hi all, I'm using Dovecot 1.2.16 (I can upgrade to 2.0 if need be) and I'm having trouble stopping Dovecot from modifying mbox files. The setup is that my main namespace points at my Maildir mail folders. In addition to this I have a second namespace that points at some old archived mbox folders. I rarely need to access these folders, but when I do Dovecot modifies the files (adding UID headers, etc). What I'd like to do is make it so that Dovecot can't change these files. I thought there might be a setting to mark a mail_location as read-only, but I can't find anything like that. I've looked at ACLs too, but they seem to be more about user access that what Dovecot can do to files. I could just do this at the filesystem level, but I'd feel a bit happier about working with Dovecot rather than trying to work around it. Does anyone have any suggestions? Thank you for reading. Tim. -- Tim Bishop http://www.bishnet.net/tim/ PGP Key: 0x5AE7D984

2 1

[Dovecot] setacl on complete mailbox
by Tobias Hachmer 12 Sep '11

12 Sep '11

Hi List, how can I grant a user full control on another mailbox (the complete mailbox with all folder and subfolders). With the setacl command I could do this but first I have to list all folders and then I have to do one setacl command for each folder. Is there a command to this in one line? Also for new created folders? Greetz, Tobias

2 1