- dovecot - dovecot.org

Re: [Dovecot] Password environment variable - logging the password
by Donovan Craig 07 Jun '09

07 Jun '09

Timo Sirainen wrote: > Hmm. I guess it's possible that the password is lost by then.. Then > another possibility would be to use passdb sql + userdb prefetch and: > > password_query = SELECT .., '%w' as userdb_plain_pass, .. That did the trick. Thanks so much for your help.

1 0

Re: [Dovecot] Password environment variable - logging the password
by Donovan Craig 07 Jun '09

07 Jun '09

>> On Jun 6, 2009, at 5:19 AM, Donovan Craig wrote: >> Im using the mysql userdb, but the passwords are stored in MD5. >> I want to be able to get the password within the post login script, >> not from >> the log file. >> >> Is there any way to do this? > Timo Sirainen wrote: > user_query = SELECT '%w' as plain_pass, ... > then it should be in $PLAIN_PASS environment in post-login script. This would be great if it worked, but unfortunately this %w is empty when I try to use it. >From the documentation, it seems that this variable is only available during auth. http://wiki.dovecot.org/Variables Is there any other way I can get the plain password within the postloginscripting? Thanks again. Donovan

2 1

Re: [Dovecot] Password environment variable - logging the password
by Donovan Craig 06 Jun '09

06 Jun '09

> look at the setting: > > # In case of password mismatches, log the passwords and used scheme so the # problem can be debugged. Requires auth_debug=yes to be set. > #auth_debug_passwords = no Thanks for your replies so far. As mentioned, I¹d like to be able to log the username and password in plain text after successful login. I¹m using the mysql userdb, but the passwords are stored in MD5. I want to be able to get the password within the post login script, not from the log file. Is there any way to do this? Thanks. Donovan

2 1

[Dovecot] Multiple Dovecot instances over single mail store
by Zohan 06 Jun '09

06 Jun '09

Hi, I need to run two Dovecot instances with totally different authentication configs: first - passwordless, based on client SSL certificate; and second - regular password based (LDAP, passwd etc.). (As far as I know this cannot be achieved with single Dovecot instance; if I'm mistaken, please correct me). My intention is to give clients dual access to their mailboxes: some do own a SSL cert, others do not. I want to know whether it is possible at all. If possible, how do we implement proper concurrent access (locking, etc.) between the two instances to a single maildir-based store? I guess this should be possible since I know Dovecot can operate NFS-backed mail stores, e.g. in a load-balancing cluster setup. Second, is it OK to run the second instance in the same OS (we use Linux)? or chroot'ed or even virtualized solution will work better? Thank you! Zohan

2 1

[Dovecot] sieve/dovecot folder separator inconsistency
by Daniel Mayer 06 Jun '09

06 Jun '09

Hi, I'm running dovecot 1.0.15 and ran recently into a problem with the folder separators when using sieve scripts. The server is set to use a slash as a folder separator for all namespaces and announces this correctly when issuing the NAMESPACE command. We are using Ingo (http://www.horde.org/ingo/) of the horde framework to manage our sieve scripts. It creates the folder name / folder path to be used in the sieve scripts based on the result of the NAMESPACE given by the IMAP Server. It therefore created the path separated by slashes ("/"). According to my tests, the delivery agent along with sieve expects the folders to be separated by dots (".") instead of slashes. Is this a correct observation or can this be set using a parameter or something similar? The result of this otherwise inconsistent behavior is that a client who sticks to the provided namespace creates a folder path which cannot be understood by the deliver process. Please let me know if you need any additional information. Thanks, Daniel

3 5

[Dovecot] Dovecot under brute force attack - nice attacker
by henry ritzlmayr 05 Jun '09

05 Jun '09

Hi List, optimizing the configuration on one of our servers (which was hit by a brute force attack on dovecot) showed an odd behavior. Dovecot Version 1.0.7 (CentOS 5.2) The short story: On one of our servers an attacker did a brute force attack on dovecot (pop3). Since the attacker closed and reopened the connection after every user/password combination the logs showed many lines like this: dovecot: pop3-login: Aborted login: user=<test>,...... The problem: If the attacker wouldn't have closed and reopened the connection no log would have been generated and he/she would have endless tries. Not even an iptables/hashlimit or fail2ban would have kicked in. How to reproduce: telnet dovecot-server pop3 user test pass test1 user test pass test2 ... QUIT ->Only the last try gets logged. If I enable auth_verbose every attempt gets logged, but if I read the docs correctly this option should only be used for figuring out why authentication isn't working. Question: Is there any way to close the connection after the first wrong user/pass combination. So an attacker would be forced to reopen it? This would be perfect since an easy iptables/hashlimit would avoid such a brute force attack. Any other Ideas? Henry

8 21

[Dovecot] v1.2.rc5 released
by Timo Sirainen 05 Jun '09

05 Jun '09

http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc5.tar.gz http://dovecot.org/releases/1.2/rc/dovecot-1.2.rc5.tar.gz.sig Some small fixes mainly. I guess I'll still have to release rc6 and rc7 after all. I've been a bit busy with v2.0 changes recently. BTW. I'm leaving tomorrow to San Francisco and I'm going to check out what's happening in Apple WWDC next week. * auth_cache_negative_ttl is now used also for password mismatches (currently only with plaintext authentication mechanisms). + Added support for EXTERNAL SASL mechanism. + FETCH X-SAVEDATE can now be used to get messages' save timestamps + deliver_log_format: %s is now in UTF8 - If message body started with a space, some operations could have assert-crashed. - Fixed using LDAP support as a plugin - Fixes to virtual mailboxes.

2 2

[Dovecot] ldap_search() failed "Server Busy"
by Paul Carter-Brown 05 Jun '09

05 Jun '09

Hi, We are using dovecot 1.1.11 on Solaris 10u6. Under load, we are experiencing the following errors: Jun 4 18:30:59 ug1s02-zone1 dovecot: [ID 107833 mail.error] auth(default): ldap(0202934816(a)ug.smilecoms.com,10.31.3.13): ldap_search() failed (filter (uid=0202934816(a)ug.smilecoms.com)) Server is busy We are authenticating against sun directory server yet see no errors in the directory server and it seems to be under low load. Any ideas if there is something on dovecot we should tune to erradicate this? We are running a web front end on top of dovecot and hence have a lot of login/logout happening as the user navigates around. I have included our config below: dovecot.conf: base_dir = /opt/csw/var/run/dovecot/ protocols = imap pop3 listen = * disable_plaintext_auth = no shutdown_clients = yes log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail ssl_listen = ssl_disable = yes login_dir = /opt/csw/var/run/dovecot/login login_chroot = yes login_user = dovecot login_process_size = 128 login_process_per_connection = no login_processes_count = 3 login_max_processes_count = 128 login_max_connections = 256 login_greeting = Dovecot ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_log_format = %$: %s mail_location = maildir:/sapool1/mail/%3n/%3.3n/%6.3n/%u mail_full_filesystem_access = yes mail_debug = no fsync_disable = yes first_valid_uid = 101 mail_save_crlf = yes mbox_dirty_syncs = yes protocol imap { login_executable = /opt/csw/libexec/dovecot/imap-login mail_executable = /opt/csw/libexec/dovecot/imap login_greeting_capability = no imap_client_workarounds = outlook-idle } protocol pop3 { login_executable = /opt/csw/libexec/dovecot/pop3-login mail_executable = /opt/csw/libexec/dovecot/pop3 pop3_no_flag_updates = no pop3_enable_last = no pop3_reuse_xuidl = no pop3_lock_session = no pop3_uidl_format = %v-%u pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s } protocol lda { postmaster_address = postmaster(a)example.com hostname = sol10-dev.dutoit.net } auth_anonymous_username = anonymous auth_verbose = no auth_debug = no auth_debug_passwords = no auth_worker_max_count = 30 auth default { mechanisms = plain passdb ldap { args = /opt/csw/etc/dovecot-ldap.conf } userdb static { args = uid=exim gid=mail home=/sapool1/mail/%u } user = root count = 1 ssl_require_client_cert = no ssl_username_from_cert = no socket listen { master { path = /opt/csw/var/run/dovecot/auth-master mode = 0600 user = root group = root } } } dict { } plugin { } dovecot-ldap.conf: hosts = ldap1.it.ug.smilecoms.com:389 dn = cn=Directory Manager dnpass = blahblah sasl_bind = no tls = no ldap_version = 3 base = dc=smilecoms,dc=com deref = never scope = subtree user_filter = (uid=%u) pass_attrs = uid=user,PIN=password pass_filter = (uid=%u) default_pass_scheme = PLAIN Thanks so much! Paul

2 3

[Dovecot] Under POP attack - now to prevent?
by James Brown 05 Jun '09

05 Jun '09

Looks like we are under a dictionary login attack on our POP server: Jun 5 11:48:20 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:24 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:25 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<austin>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:27 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<audrey>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:28 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:30 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<august>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:31 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<autumn>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:31 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<austin>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Jun 5 11:48:32 mail dovecot[2620]: pop3-login: Aborted login (auth failed, 1 attempts): user=<atlanta>, method=PLAIN, rip=85.189.169.94, lip=192.168.1.9 Any suggestions on how to prevent this? Using Dovecot 1.2RC4 Thanks, James.

5 5

[Dovecot] feature request - zlib compression via LDA
by J.P. Trosclair 05 Jun '09

05 Jun '09

Any chance of getting compression support via the zlib plugin for dovecot deliver in future versions?

2 4