- dovecot - dovecot.org

[Dovecot] How do I make dovecot not use sslv2 for pop?
by Patrick Horgan 30 Jan '10

30 Jan '10

From nmap: 995/tcp open ssl/pop3 Dovecot pop3d |_ sslv2: server still supports SSLv2 |_ pop3-capabilities: USER CAPA UIDL PIPELINING RESP-CODES TOP SASL(PLAIN LOGIN) pop3 allows SSLv2, imap doesn't. In my dovecot.conf I have: ssl_cipher_list = ALL:!LOW:!SSLv2 at the global level. Do I need to put it inside the protocol pop3{} section? Patrick

3 4

[Dovecot] Dovecot SSL issues
by Spyros Tsiolis 29 Jan '10

29 Jan '10

Hello all, successfully managed to make dovecot work with horde (http://www.horde.org) and another MTA (SMTP/POP3). I have this nagging issue with dovecot though (I suspect - it's dovecot and not the rest of the packages, please read on): There is this special page one goes, that check if everything is ok with all the relevant software running along Horde. It's a php file called "test.php". Now, this file shows almost everything that happens in the box. Here's a transcript of what shows when it comes to dovecot and SSL : --------------------------- * Trying protocol imap/ssl, Port 993: ERROR - The server returned the following error message: SECURITY PROBLEM: insecure server advertised AUTH=PLAINCertificate failure for localhost: self signed certificate: /C=GR/ST=Kerkyra/L=Kerkyra/O=The Company Name/OU=IMAP server/CN=webmail.thecompanyname.gr/emailAddress=postmaster(a)webmail.thecompanyname.gr --------------------------- From what I understand, it doesn't like the certificate. However, I've followed a howto document step-by-step and did what is documented. Does anyone have any pointers on how to make secure imap for dovecot ? E.G. on ThunderBird, the settings are the following : Tools -> Account Settings -> Server Settings : Server Name : (the server or its ip address) Username : (the username) Port : (I've manually entered "993", because by default goes to "143") Security Settings -> Connection Security : SSL/TLS (again manually entered) CHECK_ON : Use secure authentication Now, if I click on "Get Mail" button on top of the TB window, I get a pop-up window with the following message : ------ Server : Location : <Servers' IP Address>:993 Certificate Status : This site attempts to identify itself with invalid information. Wrong Site : Certificate belongs to a different site, which could indicate an identity theft. Unknown Identity : Certificate is not trusted, because it hasn't been verified by a recognized authority. ------ After that, the users accepts the above by pressing ok twice. However, there's a third pop-up window with a message shown below : ------ You cannot log in to <servers' ip address> because you have enabled secure authentication and this serer does not support it. To log in, turn off secure authentication for this account. ------ Any help would be appreciated.. Thank you all for your patience, S. Tsiolis

3 2

Re: [Dovecot] dovecot auth feature request
by Frank Cusack 29 Jan '10

29 Jan '10

On January 29, 2010 7:11:59 PM +0200 Timo Sirainen <tss(a)iki.fi> wrote: > On Fri, 2010-01-29 at 12:01 -0500, Frank Cusack wrote: >> when i try to run dovecot for SASL support only, with literally just >> this configuration: >> >> protocols = none >> ssl = no > > I suppose you didn't mean to include "ssl=no" above? yes, sorry. that is the working config. > I guess the reason I'm telling you this is because I don't really want > to add something to v1.2 that'll just go away in v2.0. pretty trivial to just include that line in the config so no worries. -frank

1 0

[Dovecot] mdbox, dsync
by Timo Sirainen 29 Jan '10

29 Jan '10

I finally migrated my mails from mbox format to mdbox format using dsync: 1. Stop dovecot, wait a few seconds for processes to die 2. dsync convert mdbox:~/mdbox 3. Change mail_location to mdbox:~/mdbox 4. Check that no new mails arrived during conversion (alternatively I could have just run dsync again, but I decided not to test my luck) 5. Start dovecot After fixing a pretty bad bug in dsync and a couple of other unrelated bugs, everything seemed to work correctly and transparently. UIDs and everything was preserved as expected. I think I even feel my mail clients being faster than with mbox :) ~% du --exclude=.imap -bsh mail-old-mbox 707M mail-old-mbox ~% du -bsh mdbox/* 27M mdbox/mailboxes 704M mdbox/storage The reason why I'm giving -b is because without it, mdbox was a lot larger than mbox (734 MB vs. 710 MB). I guess this is because zfs internally decided to waste some space for the files. ~/mdbox/storage% ls -lS -rw------- 1 tss tss 13602413 2010-01-29 18:05 m.68 -rw------- 1 tss tss 10487382 2010-01-29 18:06 m.209 -rw------- 1 tss tss 7749964 2010-01-29 18:06 m.270 -rw------- 1 tss tss 7493010 2010-01-29 18:05 m.69 .. -rw------- 1 tss tss 2097246 2010-01-29 18:06 m.175 -rw------- 1 tss tss 2097213 2010-01-29 18:06 m.151 -rw------- 1 tss tss 2097173 2010-01-29 18:06 m.197 -rw------- 1 tss tss 2097163 2010-01-29 18:05 m.89 -rw------- 1 tss tss 1307164 2010-01-29 18:33 m.296 Total of 296 files. The reason why there are a few large files is because their last mail is huge. I guess in future mdbox should try to avoid doing that if it knows the mail's size beforehand. Actually I thought it already tried to do that.. Anyway, let's hope it doesn't now corrupt all my mails.

3 3

[Dovecot] dovecot auth feature request
by Frank Cusack 29 Jan '10

29 Jan '10

when i try to run dovecot for SASL support only, with literally just this configuration: protocols = none ssl = no auth default { mechanisms = plain login passdb passwd-file { args = /etc/dovecot/passwd } socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 } } } I get this: Error: ssl_cert_file: Can't use /etc/ssl/certs/dovecot.pem: No such file or directory Since, in this configuration, SSL doesn't have meaning, dovecot shouldn't be looking for any cert file. Easily fixed with "ssl = no" but that shouldn't be required. -frank

2 1

[Dovecot] mailbox format w/ separate headers/data
by Frank Cusack 29 Jan '10

29 Jan '10

In the future, it would be cool if there were a mailbox format (dbox2?) where mail headers and each mime part were stored in separate files. This would enable the zfs dedup feature to be used to maximum benefit. In the zfs filesystem, there is a dedup feature which stores only 1 copy of duplicate blocks. In a normal mail file, the headers will be different for each recipient and the chances of the content of the message being able to be dedup'd are close to zero, because the differences in header length changes the block boundaries for the rest of the message. But if each mime part is stored in a separate file, you get massive compression "for free". -frank

5 16

[Dovecot] Master user and proxying
by BaQs 29 Jan '10

29 Jan '10

Hello list, Still need your help configuring proxy infrastructure. Today, I really struggle configuring master passwords forwarding. What I want: master user can connect to any other account, on proxy. Could please somebody help me, I read both articles about this on wiki, but still can't connect :( What I did: on proxy: auth_master_user_separator=* passdb sql { args = /usr/local/dovecot/etc/dovecot-master.conf master = yes pass = yes } -- dovecot-master.conf: (...) default_pass_scheme = CRYPT password_query = SELECT password FROM master_users WHERE username= '%u' AND status = 'ok' -- on destination server: auth_master_user_separator=* passdb sql { args = /usr/local/etc/dovecot-master.conf master = yes pass = yes } default_pass_scheme = CRYPT password_query = SELECT password FROM master_users WHERE username= '%u' AND status = 'ok' I also tried on proxy: password_query = SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'%u' as user ,'%u*pierre' as destuser, '123' as pass FROM proxy WHERE domain = '%d' instead of password_query = SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'%u' as user FROM proxy WHERE domain = '%d' it did not work :( -------- LOGS: -------- on destination server: [ID 583609 mail.info] auth(default): cache(pierre,127.0.0.1,master): expired [ID 583609 mail.info] auth-worker(default): sql(pierre,127.0.0.1): query: SELECT password FROM master_users WHERE username= 'pierre' AND status = 'ok' [ID 583609 mail.info] auth(default): passdb(pierre,127.0.0.1,master): Master user logging in as account(a)test.fr*pierre [ID 583609 mail.info] auth(default): cache(account(a)test.fr*pierre,127.0.0.1): miss [ID 583609 mail.info] auth-worker(default): sql(account(a)test.fr*pierre,127.0.0.1): query: SELECT CONCAT(pw_name, '@', pw_domain) AS user, pw_passwd AS password FROM vpopmail WHERE pw_name = 'julien' AND pw_domain = 'demarey.fr*pierre' [ID 583609 mail.info] auth-worker(default): sql(account(a)test.fr*pierre,127.0.0.1): unknown user [ID 583609 mail.info] auth(default): new auth connection: pid=8162 [ID 583609 mail.info] auth(default): client out: FAIL 1 user=account(a)test.fr*pierre authz on proxy: auth(default): client in: AUTH 2 PLAIN service=imap secured lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39978 resp= auth(default): cache(pierre,127.0.0.1,master): hit: user=pierre auth(default): passdb(pierre,127.0.0.1,master): Master user logging in as account(a)test.fr auth(default): cache(account(a)test.fr,127.0.0.1): miss auth-worker(default): sql(account(a)test.fr,127.0.0.1): query: SELECT NULL AS password, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy,'account(a)test.fr' as user ,'account(a)test.fr*pierre' as destuser, '123' as pass FROM proxy WHERE domain = 'demarey.fr' auth(default): client out: OK 2 user=account(a)test.fr host=10.0.44.20 nologin proxy destuser=account(a)test.fr*pierre pass= master=pierre imap-login: proxy(account(a)test.fr): Login failed to 10.0.44.20:143/account@test.fr*pierre (master pierre): [AUTHORIZATIONFAILED] Authorization failed [ID 583609 mail.info] imap-login: Disconnected (auth failed, 1 attempts): user=, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured both use dovecot version 1.2.9

2 1

Re: [Dovecot] How do I make dovecot not use sslv2 for pop?
by Andreas Schulze 29 Jan '10

29 Jan '10

> From: Timo Sirainen <tss(a)iki.fi> > Subject: Re: [Dovecot] How do I make dovecot not use sslv2 for pop? > Message-ID: <1264724551.22202.139.camel@hurina> > > Anyway.. I guess I should do something about this. Not really sure what, > though. Timo, you can simply stop supporting SSLv2. Nobody really needs security known to be insecure. -- Andreas Schulze Internetdienste | P532 DATEV eG 90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196 E-Mail info @datev.de | Internet www.datev.de Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70 Vorstand Prof. Dieter Kempf (Vorsitzender) Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender) Dipl.-Kfm. Michael Leistenschneider Jörg Rabe v. Pappenheim Dipl.-Vw. Eckhard Schwarzer Vorsitzender des Aufsichtsrates: Reinhard Verholen

3 2

[Dovecot] Courier-to-Dovecot-migration: Outlook downloads all Mails again
by Werner 29 Jan '10

29 Jan '10

Hi everybody, I'm currently playing through the migration from Courier to dovecot. I've converted the User's Maildir with 'courier-dovecot-migrate.pl'. Outlook 2003 is configured to access the Mailbox via POP3, the option "Leave a copy of messages on the server" is activated. But: after the migration Outlook 2000 redownloads all mails again :-( Could it be, that Outlook 2000 "thinks" (after changing the POP3/SMTP-Server in the Outlook configuration pointing to my testsystem) this is a new system and starts to download the messages again? If so, Outlook 2000 won't download all messages again if we do the migration because POP3/SMTP-Server remains the same. Can anybody confirm this? We do not experience this issue with Thunderbird for example. Thank you, Werner

2 2

[Dovecot] virtual users with mysql
by Andre Hübner 28 Jan '10

28 Jan '10

Hello List, we use in our system cryptical Usernames for dovecot etc. and authenticate users against shadow/passwd User abcde is loging in and gets data from /var/spool/mail/abcde and /home/popuser/abcde Now we want to make it possible that users can log in also with emailadresses. I tried dovecot-mysql authentication which works fine but i do not find a way to use 2 different login-formats in my queries. login with abcde and also testname(a)example.com should return ok and lead to /var/spool/mail/abcde. Is this possible or i have to make a decision which format to use? Thanks, Andre

2 2