- dovecot - dovecot.org

Bug report: Global Mailbox UID mismatch on replication when upgrading from 2.3.13 to 2.3.17
by Dennis Højgaard | Powerhosting Support 17 Nov '21

17 Nov '21

Hi. We use dovecot for replication on two dovecot nodes (using Maildir). Worked perfectly until upgrading from 2.3.13 to 2.3.17. I found out about it a couple of days after where Queued 'full resync' requests had gone up. And then i saw some failed requests. But nothing in the log. I found out which users having trouble and saw that it was new user so i ran doveadm sync manually and got the following error: doveadm(2849817): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 38e69e0ba98d936142ac29004e3fea09 (maybe it was just deleted?) So i found out that dovecot-uidlist had a mismatch on the Global Mailbox UID, so global mailbox uid is not the same on both servers for new users. I don't know if there is something that has changed with regards to how this GUID is generated, because when i look at old mailboxes they are always identical on both servers. I fix this issue manually by editing dovecot-uidlist on one of the servers making the global mailbox uid on both servers identical, and then run force-resync. This works, but i guess something has changed. -- Dennis Højgaard Powerhosting Support t: +45 7222 4457 | e: dh(a)powerhosting.dk | w: https://powerhosting.dk

1 0

Postfix -> bogogilter -> Dovecot -> Sieve
by Mike 17 Nov '21

17 Nov '21

I've been trying to work out how to get postfix to accept mail, send it to bogofilter, then deliver using dovecot while allowing a global sieve filter and users able to filter mail based on the bogofilter header. I've been successful at getting it to add the bogofilter header as needed, but don't understand what I need to do in order to have it get routed to sieve. Anyone do anything like this already and have a working config? I THINK I need to make dovecot deliver mail locally using lmtp or lda, but I'm not exactly sure. Thanks for any thoughts or ideas that you might have to accomplish this. Mike.

3 2

Help needed for OAuth and WSO2 Identity Server
by Tyler Montney 16 Nov '21

16 Nov '21

As outlined here: https://doc.dovecot.org/configuration_manual/authentication/oauth2/ Can Postman https://identity.foo.mylocal:9443/oauth2/token OK. Using this command to generate the base64 token: echo -en 'n,a=test(a)foo.com,\001host=localhost\001port=143\001auth=Bearer S3cure!Password\001\001' | base64 -w0; echo I telnet to localhost 143, and run 01 AUTHENTICATE OAUTHBEARER {TOKEN}. Get 'User id is not available for user: FOO.MYLOCAL/test(a)carbon.super' (HTTP 500). It could be because Dovecot is just sending a username instead of the full email address? I can generate the same 500 error by just sending the username in Postman. ***dovecot-oauth.conf.ext*** introspection_mode = post introspection_url = https://adminusername:adminpassword@identity.foo.mylocal :9443/oauth2/introspect username_attribute = username tls_allow_invalid_cert = yes active_attribute = active active_value = true use_grant_password = yes # Have tried this, no change. #username_format = %n client_id = {CLIENTID} client_secret = {CLIENTSECRET} grant_url = https://identity.foo.mylocal:9443/oauth2/token tokeninfo_url = https://identity.foo.mylocal:9443/oauth2/tokeninfo?oauth= pass_attrs = pass=%{oauth2:access_token} ***dovecot.conf*** auth_mechanisms = $auth_mechanisms oauthbearer xoauth2 passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext }

1 0

Dovecot and certificates/keys on PKCS11 smartcards/HSMs
by Graham Leggett 16 Nov '21

16 Nov '21

Hi all, To configure SSL on dovecot using certificates and keys in files on disk, you specify the following: # Preferred permissions: root:root 0400 ssl_cert = </etc/ssl/dovecot.pem ssl_key = </etc/ssl/dovecot.pem Is there a syntax that will allow a certificate and key to be specified on a smartcard/HSM, as is possible (for example) for httpd at https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslcertificatefile: # Example use of a certificate and private key from a PKCS#11 token: SSLCertificateFile "pkcs11:token=My%20Token%20Name;id=45” Regards, Graham —

1 0

Bug report: Global Mailbox UID mismatch on replication when upgrading from 2.3.13 to 2.3.17
by Dennis Højgaard | Powerhosting Support 16 Nov '21

16 Nov '21

Hi. We use dovecot for replication on two dovecot nodes (using Maildir). Worked perfectly until upgrading from 2.3.13 to 2.3.17. I found out about it a couple of days after where Queued 'full resync' requests had gone up. ANd then i saw some failed requests. But nothing in the log. I found out which users having trouble and saw that it was new user so i ran doveadm sync manually and got the following error: doveadm(2849817): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 38e69e0ba98d936142ac29004e3fea09 (maybe it was just deleted?) So i found out that dovecot-uidlist had a mismatch on the Global Mailbox UID, so global mailbox uid is not the same on both servers. I don't know if there is something that has changed with regards to how this GUID is generated, because when i look at old mailboxes they are always identical on both servers. I fix this issue manually by editing dovecot-uidlist on one of the servers making the global mailbox uid on both servers identical, and then run force-resync. This works, but i guess something has changed. -- Dennis Højgaard Powerhosting Support *t:* +45 7222 4457 |*e:* dh(a)powerhosting.dk |*w:* https://powerhosting.dk

1 0

Subfolder in sieve not working as expected
by Kees van Vloten 16 Nov '21

16 Nov '21

On 15-11-2021 23:04, dovecot(a)ptld.com wrote: >> On 11-15-2021 3:46 pm, Kees van Vloten wrote: >> >> I am trying to move incoming mails into subfolders with this sieve >> script: >> >> require ["fileinto", "variables", "mailbox"]; >> if header :matches "Delivered-To" "*@*" >> { >> fileinto :create "INBOX/${2}"; >> } > > I am not using variables and my folders are pre-created. But just to > give you a starting point, this is what works using maildir++ format > with default directory layout. > https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ > > require ["fileinto"]; > # rule:[Dovecot] > if header :contains "sender" "@dovecot.org" > { > fileinto "INBOX.Dovecot"; > } I have seen that working in the past :-) I switched to LAYOUT=fs recently because of the limitations of the dot as a folder separator (now I can have the domain-name as a folder-name). I found a nice description about folder and namespace issues here: https://forum.hestiacp.com/t/character-not-allowed-in-mailbox-name/566/4 But somehow the sieve implementation does not seem to work properly with LAYOUT=fs. What a good approach to further analyze this issue?

1 0

[Move mailboxes] 2.2.13 -> 2.3.13: Stuck on certificate verification
by phren＠ist-einmalig.de 15 Nov '21

15 Nov '21

Hi, I'm about to move all mailboxes from an old machine - running Dovecot 2.2.13 - to a new machine - running Dovecot 2.3.13 (89f716dc2). Cause the new machine is in a different location I must use SSL encryption. I followed the guide's I found, but I stuck on certificate verification: $ doveadm backup -Ru <user> tcps:<host>:12354 doveadm(<user>): Info: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) On port 12354 the server sends an incomplete certificate chain, whereas on port 993 everything is fine. I read that the settings - ssl_client_ca_dir - ssl_client_ca_file are not used on certificate verification for port 12354, one should use the setting ssl_ca Here are the non-default setting on the client side: $ dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-9-amd64 x86_64 Debian 11.1 ... ssl_ca = </etc/dovecot/dovecot_imap_chain.crt ssl_cert = </etc/ssl/letsencrypt.org/<host>.combine.crt ssl_cipher_list = EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+AES256:!aNULL:!eNULL:!LOW:!MEDIUM:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt ... ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes ... verbose_ssl = yes ssl_verify_client_cert = yes According to https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/ the setting ssl_ca should contain Issuing CA cert Issuing CA CRL Intermediate CA cert Intermediate CA CRL Root CA cert Root CA CRL But how do I build this file? I tried root certificate, root + intermediate certificate and root + intermediate + signed certificate. None of them made it work... I'm completely stuck on how to make certificate verification work. Can anyone give me a hint? Thanks in advance.

1 0

Strategies for protecting IMAP (e.g. MFA)
by Kees van Vloten 14 Nov '21

14 Nov '21

Apart from a really nice firewall firehol also supplies a good set of ip-blacklists. For public exposure of email ports, I am using the combination of firehol-firewall, firehol-blacklist, fail2ban and a whitelist based on geo-ip. The mail-client ports exposed are 993 and 465, because starttls is considered flawed nowadays: https://nostarttls.secvuln.info/) Full access from any IP (except firehol-blacklist and fail2ban) is possible over VPN (openvpn) with MFA (privacyidea). Privacyidea also supplies a mobile-app compatible with a.o. TOTP and HOTP but it provides a more secure way of enrollment (2-step). Thanks for pointing at crowdsec.net, will see if it can tighten security further in cooperation with the above. - Kees On 14-11-2021 11:33, infoomatic wrote: > I will throw in a few interesting projects which have kept my small > servers safe: > > *) firehol.org > > *) crowdsec.net > > *) www.fail2ban.org > > Have a look at those interesting projects! > > > On 13.11.21 22:16, Tyler Montney wrote: >> With the world of ransomware as it is today (aka attacks seem more >> vicious and commonplace), anything I expose to WAN must have >> additional protection. I've seen a few posts to this list on it. The >> only thing that helped was that Dovecot supports OAuth. Through OAuth >> I figure I could implement MFA. However, I'd have to host my own >> identity server. From there, Thunderbird supports OAuth so that should >> work. >> >> Since this is getting increasingly complicated, I wanted to ask before >> going further. What do you all do? Any recommendations?

4 4

Re: Strategies for protecting IMAP (e.g. MFA)
by Marc 14 Nov '21

14 Nov '21

Don't use email addresses as login ;) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -. F1 Outsourcing Development Sp. z o.o. Poland t: +48 (0)12 4207 835 e: marc(a)f1-outsourcing.eu

3 3

IPv4/v6 based access checking and logging
by Lefteris Tsintjelis 13 Nov '21

13 Nov '21

Hi, I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this: https://doc.dovecot.org/configuration_manual/lastlogin_plugin/ Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go? Regards, Lefteris

3 6