- dovecot - dovecot.org

[Dovecot] ACL plugin
by Matvey Soloviev 01 Oct '08

01 Oct '08

Hello, I am working on implementing support for the RFC4314 ACL management commands and responses in the ACL plugin included with dovecot 1.1.2. (I verified the error persists with 1.1.3 though.) While the described objective is still in the works, I have stumbled upon what I believe to be a critical issue with the handling of negative rights in the present ACL plugin - to be precise, the cache component of it handles them in the exact same way as it does positive rights, thus granting rather than retracting the individual privileges. To fix this, go to src/plugins/acl/acl-cache.c:391. The line and the one following it should read p[j] |= obj_cache->my_neg_rights[i]->mask[j]; Replace that to read p[j] &= ~obj_cache->my_neg_rights[i]->mask[j]; I hope this information is useful. Regards, M. Soloviev

4 7

[Dovecot] "dovecot: Maximum number of mail processes exceeded"
by Ralf Hildebrandt 01 Oct '08

01 Oct '08

At noon, I often get "dovecot: Maximum number of mail processes exceeded" I'm at my wits end, which parameter needs to be increased further? # 1.1.3: /usr/local/etc/dovecot.conf protocols: imap imaps pop3s ssl_cert_file: /etc/ssl/certs/postamt.pem ssl_key_file: /etc/ssl/private/postamt.key disable_plaintext_auth: no version_ignore: yes login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_process_per_connection: no login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no login_processes_count: 32 login_max_processes_count: 2048 login_max_connections: 512 max_mail_processes: 1024 mail_max_userip_connections: 2048 verbose_proctitle: yes mail_location: maildir:~/Maildir fsync_disable: yes maildir_copy_preserve_filename: yes mail_drop_priv_before_exec: yes mail_executable(default): /usr/local/sbin/imap_login_script mail_executable(imap): /usr/local/sbin/imap_login_script mail_executable(pop3): /usr/local/sbin/pop_login_script mail_plugins(default): quota imap_quota trash mail_log fts fts_squat mail_plugins(imap): quota imap_quota trash mail_log fts fts_squat mail_plugins(pop3): quota mail_log mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 mail_log_max_lines_per_sec: 0 imap_client_workarounds(default): outlook-idle netscape-eoh imap_client_workarounds(imap): outlook-idle netscape-eoh imap_client_workarounds(pop3): pop3_lock_session(default): no pop3_lock_session(imap): no pop3_lock_session(pop3): yes pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v-%u pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh namespace: type: private separator: . prefix: INBOX. inbox: yes list: yes subscriptions: yes auth default: mechanisms: plain login cache_size: 64 master_user_separator: * verbose: yes passdb: driver: passwd-file args: /usr/local/etc/dovecot.masterusers pass: yes master: yes passdb: driver: shadow passdb: driver: pam args: cache_key=%u dovecot userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix plugin: fts: squat quota: maildir quota_rule: Trash:storage=100M quota_warning: storage=90%% /usr/local/scripts/quota-warning 90 quota_warning2: storage=95%% /usr/local/scripts/quota-warning 95 quota_warning3: storage=99%% /usr/local/scripts/quota-warning 99 trash: /usr/local/etc/dovecot-trash.conf -- Ralf Hildebrandt (Ralf.Hildebrandt(a)charite.de) snickebo(a)charite.de Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155 http://www.arschkrebs.de I'm looking for a job Vampireware /n/, a project, capable of sucking the lifeblood out of anyone unfortunate enough to be assigned to it, which never actually sees the light of day, but nonetheless refuses to die.

2 2

[Dovecot] disbale to responded to an unrequested SSL Certificate
by Andre Hübner 01 Oct '08

01 Oct '08

Hi dovecot-list, just a easy question today ;) Customer did on Server a PCI-Test to test security to fit worldpay requirements. They found a critical risk at pop3s. (and some other things) This is the Textmesage: ############ Family: Remote Shell Access Critical 993/tcp 11875 Description: The remote host responded to an unrequested SSL Certificate. The remote SSL server should have sent back an Error message. This may indicate that the server is vulnerable to a remote flaw in the way that it handles unrequested certificates. You should manually inspect the SSL Server's configuration ############ Background is that we use a wildcard-cert which is installed on ervery machine and fits to servername. So you have to use the accredited Hostname/Servername to make clean ssl connection pop3s/imaps without warnings etc. Problem should be that server sends no error when requested with other hostname. This is significant part from dovecot.conf protocols = imap imaps pop3 pop3s ssl_disable = no ssl_cert_file = "/path/to/*.myhost.com.crt" ssl_key_file = "/path/to/*.myhost.com.key" ssl_ca_file = "/path/to/*.myhost.com.bundle.crt" Is there a Config-Option to send error when ssl-connect ist not established to in cert accredited Hostname/Servername ? Did not found something like this or did not really understand function of the options. I do not know backgrounds to this issue. Cant decide if it would be a security risk or disproportionated wishes of securityexperts but i want to satisfy this costumer. How to handle thos? Thank you Andre

2 1

[Dovecot] quota warnings clarification
by Ian B 01 Oct '08

01 Oct '08

I spent a long while trying to get quota warnings working with v1.1.3 on Centos5 before almost giving up. I configured everything as per the instructions on the Quota wiki page however no warning emails were being generated when I tested & no debug messages in the log to give any clues as to what I was doing wrong. It turns out I wasn't doing anything wrong, but just misunderstanding at what point the warnings are generated. The warning email appears to only be generated when a message is moved from one folder to another. I was expecting the warning to be generated when the INBOX was simply opened & viewed! Is this how it is supposed to work? If so, perhaps a note of clarification could be added to the wiki page? Make the switch to the world's best email. Get Yahoo!7 Mail! http://au.yahoo.com/y7mail

2 2

[Dovecot] Managesieve Quota
by Seth Mattinen 30 Sep '08

30 Sep '08

Has anyone (is anyone) working on adding quota support to dovecot's managesieve server? I was thinking about giving it a shot myself and I'd hate to duplicate work. It would be something very basic like a max bytes setting and the total sieve storage per user isn't allowed to exceed it. ~Seth

4 7

[Dovecot] PKI Compliance Dovecot Server
by Amit Thakkar 30 Sep '08

30 Sep '08

Hello, I work for an organization that uses a Secure Dovecot server for messaging, and recently we've had to undergo some security screenings for PKI compliance (credit card industry standards). However, the screening returned to us a failure due to the following reason (attributed to our Dovecot server, which runs on port 993 and is the only "open" port on our firewall): Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers fromseveral cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. See http://support.microsoft.com/kb/216482 for instructions on IIS. See http://httpd.apache.org/docs/2.0/mod/mod _ssl.html for Apache. Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) [More] Is there a way that we can disable SSL 2.0 in Dovecot, or force it to use only TLS 1.0 ? Thank You

4 3

[Dovecot] dovecot quota messages
by Cosmin Natea 30 Sep '08

30 Sep '08

Hi. I have a question about quota messages (dovecot 1.1.3). I'm trying to use quota messages for moving messages in a new folder when they reach a certain number(10000). I made the script which is called when quota_warning condition is met. Then i made a rule to exclude that folder from quota, quota_rule3:folder:ignore The problem is that this folder is still counted in quota. I don't know if this is a bug or this is how ignore is supposed to work(maybe ignore works only for storage).

1 0

[Dovecot] dovecot quota messages problem
by costexx 30 Sep '08

30 Sep '08

Hi. I have a question about quota messages (dovecot 1.1.3). I'm tryng to use quota messages for moving messages in a new folder when they reach a certin number(10000). I made the script which is called when quota_warning condition is met. Then i made a rule to exclude that folder from quota, quota_rule3:folder:ignore The problem is that this folder is still counted in quota. I don't know if this is a bug or this is how ignore is suposed to work(maibe ignore works only for storage). -- View this message in context: http://www.nabble.com/dovecot-quota-messages-problem-tp19738722p19738722.ht… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] dovecot 1.2.alpha1 quota dict driver mysql broken
by Robert Schetterer 29 Sep '08

29 Sep '08

Hi Timo, quota dict seems to be broken with 1.2.alpha1 MAP(robert(a)schetterer.com): read(/var/run/dovecot/dict-server) failed: Remote disconnected dovecot: Sep 24 18:43:16 Error: dict: Error in configuration file /etc/dovecot/dovecot-dict-quota.conf line 1: Unknown setting: driver dovecot: Sep 24 18:43:16 Error: dict: Failed to initialize dictionary 'quotadict' etc/dovecot/dovecot-dict-quota.conf driver = mysql connect = host=localhost dbname=postfix user=postfix password=... default_pass_scheme = PLAIN table = quota select_field = current where_field = path username_field = username worked with 1.1.3 -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

2 8

[Dovecot] login processes killed with signal 15
by Radu Popescu 29 Sep '08

29 Sep '08

[root@xxx etc]# dovecot --version 1.1.3 [root@adi-ion etc]# dovecot -n # 1.1.3: /usr/local/etc/dovecot.conf log_path: /var/log/dovecot protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/postfix/smtpd.cert ssl_key_file: /etc/postfix/smtpd.key disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:/home/vmail/%d/%n/ mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v.%u auth default: mechanisms: plain login debug: yes debug_passwords: yes passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen master: path: /usr/local/var/run/dovecot/auth-master mode: 384 user: vmail group: vmail The log looks like this - it happens every few days: dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: auth(default): Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: I/O leak: 0x407150 (24) deliver(xxx(a)xxx.com): Sep 28 04:07:04 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:07:53 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:08:12 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:13:18 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:13:18 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory It's not a rpm installation, it compiled by me. The OS is a CentOS5.2.

2 1