- dovecot - dovecot.org

[Dovecot] login processes from attacks staying for hours
by Kai Schaetzl 31 Jul '08

31 Jul '08

I'm in the process of rolling out new setups with dovecot on CentOS 5.2 and I notice that dovecot doesn't handle the brute-force attacks too nice. I reduced the limit a bit to some reasonable looking value: login_max_processes_count = 32 to stop them earlier and the number of processes stops at that figure when an attack happens. However, it stays at this count for hours although the attack is already over since long. For instance, my monitoring alerts me at the moment when the process count for pop3-login goes over 20 processes. This happened on three machines at 2 am with a brute-force attack from the same source that didn't last longer than a minute or so. However, the process count dropped only at 7am under 20 on two machines and on the third machine it was still over 20 when I was in the office at 9 am and finally killed them. As these machines are all not in production yet, there weren't any other logins and the single brute-force ended within one minute according to the logs (obviously when pop3-logins hit the limit). Shouldn't these processes go down to login_processes_count (3) within a few minutes? An strace shows that they are mostly doing gettimeofday lookups (=sleeping). This is the default dovecot (1.07) coming with CentOS 5.2. I've been running only one other instance of dovecot in production (0.99.11) on CentOS 4.6 so far and I don't know which behavior that displayed in the past as I just recognize that I accidentally ommitted it from monitoring. :-( I had this mailing list searched for "brute-force" to see how others handle this and what dovecot provides to stop these attacks. I have found not many threads about this. There is one with a bit more information: "Delay on failed pw attempts" from January 1. Unfortunately, this functionality is only in a later version of dovecot and it's not clear if it was implemented or not or if it would be helpful. Was it implemented? This thread also mentions fail2ban which may be one way to go, although I don't like this log parsing approach too much. Does anyone use iptables for rate-limiting per IP on the pop/imap ports to prevent brute-force attacks? Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

7 9

[Dovecot] installing plugin (autocreate_plugin.c)
by Marcin Gryszkalis 31 Jul '08

31 Jul '08

Hi I want to enable autocreate-plugin, I downloaded http://dovecot.org/patches/1.1/autocreate-plugin.c compiled as specified in comment and got autocreate_plugin.so but I'm not sure how do I install it. I have many plugins in /usr/local/lib/dovecot/ (it's FreeBSD) and subdirs, but they all have libXX_ prefixes (what do they mean?). I couldn't find any information about installing plugins on dovecot's wiki and I don't want to experiment as the server is live (not really important but still live). regards -- Marcin Gryszkalis, PGP 0x9F183FA3 jabber jid:mg@fork.pl, gg:2532994 http://the.fork.pl

2 1

[Dovecot] Some help required - dovecot: IMAP(matthew): unlink(/home/matthew/Maildir/cur/new) failed: Operation not permitted
by matbic＠gmail.com 31 Jul '08

31 Jul '08

Hi all, I have tried very hard to solve this problem but turn to the mailing list as a last resort. In the log I get, for just one account: Jul 31 09:06:17 bickertons dovecot: imap-login: Login: user=<matthew>, method=PLAIN, rip=78.130.81.201, lip=168.143.5.18, TLS Jul 31 09:06:17 bickertons dovecot: IMAP(matthew): Effective uid=1003, gid=1003, home=/home/matthew Jul 31 09:06:17 bickertons dovecot: IMAP(matthew): maildir: data=/home/ matthew/Maildir Jul 31 09:06:17 bickertons dovecot: IMAP(matthew): maildir: root=/home/ matthew/Maildir, index=/home/matthew/Maildir, control=, inbox= Jul 31 09:06:17 bickertons dovecot: IMAP(matthew): unlink(/home/ matthew/Maildir/cur/new) failed: Operation not permitted Jul 31 09:06:18 bickertons last message repeated 3 times All the other accounts work fine. I have tried removing the dovecote.index and the dovecote-keywords and uidlist files. This gets it working for a while but soon we are back to the same problem. I would really not like to lose all the mail in this account, its that of my boss, (slight note of panic) Matthew bickertons# dovecot --version 1.0.13 bickertons# dovecot -n # 1.0.13: /usr/local/etc/dovecot.conf protocols: imap imaps pop3 pop3s disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login login_max_processes_count: 30 max_mail_processes: 50 verbose_proctitle: yes first_valid_gid: 0 mail_privileged_group: mail mail_location: maildir:~/Maildir mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 imap_client_workarounds(default): delay-newmail outlook-idle netscape- eoh tb-extra-mailbox-sep imap_client_workarounds(imap): delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep imap_client_workarounds(pop3): outlook-idle pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %08Xu%08Xv pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls oe-ns-eoh auth default: passdb: driver: pam args: * userdb: driver: passwd

2 1

[Dovecot] lib90_cmusieve_plugin.so: undefined symbol: message_decoder_init
by Thomas Harold 31 Jul '08

31 Jul '08

After upgrading our CentOS 5 box to the latest revisions last week (including Dovecot 1.1), we're seeing the following error message in the log files. Sieve was working fine with Dovecot 1.0. I have yet to turn up anything via Google for this particular error. SELinux is not logging any error messages at the moment, so I'm pretty sure that we've properly allowed all the SELinux permissions. # cat /var/vmail/dovecot-deliver.log deliver(ruth(a)example.com): Jul 28 11:11:44 Error: dlopen(/usr/lib64/dovecot/lda/lib90_cmusieve_plugin.so) failed: /usr/lib64/dovecot/lda/lib90_cmusieve_plugin.so: undefined symbol: message_decoder_init deliver(ruth(a)example.com): Jul 28 11:11:44 Fatal: Couldn't load required plugins # ls -l /usr/libexec/dovecot/sievec -rwxr-xr-x 1 root root 165152 Jun 11 03:21 /usr/libexec/dovecot/sievec # ls -l /usr/lib64/dovecot/lda/lib90_cmusieve_plugin.so -rwxr-xr-x 1 root root 141328 Jun 11 03:21 /usr/lib64/dovecot/lda/lib90_cmusieve_plugin.so # yum list | grep "dovecot" dovecot.x86_64 1:1.1.1-2_76.el5 installed dovecot-sieve.x86_64 1.1.5-8.el5 installed dovecot.x86_64 1:1.1.2-2_77.el5 atrpms dovecot-devel.x86_64 1:1.1.2-2_77.el5 atrpms

3 8

[Dovecot] broken links to xexec module and patches
by mail＠viliar.net.ru 30 Jul '08

30 Jul '08

>From this page attaches cannot be downloaded anymore: http://wiki.dovecot.org/Plugins/xexec Error: You are not allowed to do AttachFile on this page. Login and try again. Clear message Probably files should be placed here http://www.dovecot.org/patches/ And on page above just links to it? A. -------------- "Hic Jacet Ego" gpg key: http://viliar.net.ru/public.gpg

3 3

Re: [Dovecot] broken links to xexec module and patches
by mail＠viliar.net.ru 30 Jul '08

30 Jul '08

I already ask it in maillist. Please, see first letter. I'm not the module author or author of contributed patch to remake links at wiki on my way, for example. There are free files. Original source for xexec module, kindly given by you. Patch from Stephan, to make xexec work with dovecot 1.1 and prepatched source by me after testing Stephan patch. Yes, I have the files too, so at least now it can be downloaded: Original xexec source from wiki. http://files.viliar.net.ru/os/xexec.tar.gz Patch to original xexec for dovecot 1.1 from Stephan. from his site: http://www.rename-it.nl/dovecot/patches/dovecot-xexec-1.1.v2.patch or here: http://files.viliar.net.ru/os/dovecot-xexec-1.1.v2.patch Prepatched: http://files.viliar.net.ru/os/xexec.1.1.v2.tar.gz > Why don't you write Timo about this because I don't think I have the > latest files. Ask why the links don't work. > > mail(a)viliar.net.ru wrote: >>> mail(a)viliar.net.ru wrote: >>> >>>> >From this page attaches cannot be downloaded anymore: >>>> http://wiki.dovecot.org/Plugins/xexec >>>> >>>> Error: >>>> You are not allowed to do AttachFile on this page. Login and try >>>> again. >>>> Clear message >>>> >>>> >>> Oh yeah, that's right. AttachFile got disallowed recently. I have the >>> patch for v1.1 available at: >>> >>> http://www.rename-it.nl/dovecot/patches/dovecot-xexec-1.1.v2.patch >>> >>> I think Marc Perkel will have the original xexec.tar.gz somewhere. >>> Perhaps he could put it online somewhere and adjust the wiki >>> accordingly? >>> >> >> Both ways, imho, good. Just to be assured, it can be downloaded >> somethere. >> ( I just found in my logs (by referer) user googling query, where he >> seek >> place to download xexec... :-) ) >> >> >> >> A. >> >> -------------- >> >> "Hic Jacet Ego" >> >> gpg key: http://viliar.net.ru/public.gpg >> >> >> >> > A. -------------- "Hic Jacet Ego" gpg key: http://viliar.net.ru/public.gpg

1 0

[Dovecot] Xexec Wiki Links Broken?
by Marc Perkel 30 Jul '08

30 Jul '08

Someone pointed out to me that the links to the code on the wiki for xexec no longer work. Can someone fix this?

1 0

[Dovecot] DoveCot IMAP and "inconsistent state" messages
by Chris Richards 30 Jul '08

30 Jul '08

I need some help troubleshooting this problem. It only shows up with IMAP connections. I initially thought it was related to SquirrelMail (because it gives me an 'EXPUNGE' error), but after attempting to send IMAP commands directly to the server as shown below, I'm thinking there is something else going on. The system configuration is PostFix as the MTA delivering to procmail in the mailbox (maildir format), with Dovecot handling POP3 and IMAP Postfix is version 2.3.3 Dovecot is version 1.0.rc15 procmail is version 3.22 2001/09/10 kernel is 2.6.18-53.1.14.el5, CentOS 5 There is additional info about the system configuration after the command sequence and log entries below. I've left my typos in, just in case they somehow bear on the problem. I omitted about 2050 messages from the mailbox FETCH listing, since they were all identical but for the message number, and I didn't figure you'd want to read all of that. :) Command sequence: [me@myserver~]$ telnet locahost 143 locahost/143: Name or service not known [me@myserver~]$ telnet localhost 143 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. * OK myserver awaiting command login me mypass login BAD Error in IMAP command received by server. a001 login me mypass a001 OK Logged in. a002 list "Mail" "*" a002 OK List completed. a003 list "Folders" "*" a003 OK List completed. a004 list "Inbox" a004 BAD Error in IMAP command LIST: Invalid arguments. a005 list "Inbox" "*" * LIST (\HasNoChildren) "." "INBOX" a005 OK List completed. a006 list "" "*" * LIST (\HasNoChildren) "." "Drafts" * LIST (\HasNoChildren) "." "Spam" * LIST (\HasNoChildren) "." "Trash" * LIST (\HasNoChildren) "." "Sent" * LIST (\HasNoChildren) "." "INBOX" a006 OK List completed. * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 2088 EXISTS * 1 RECENT * OK [UNSEEN 2088] First unseen. * OK [UIDVALIDITY 1190322195] UIDs valid * OK [UIDNEXT 89700] Predicted next UID a007 OK [READ-WRITE] Select completed. a008 FETCH l:* FLAGS a008 BAD Error in IMAP command FETCH: Invalid messageset a008 FETCH 1:* FLAGS * 1 FETCH (FLAGS (\Seen)) * 2 FETCH (FLAGS (\Seen)) * 3 FETCH (FLAGS (\Seen)) * 4 FETCH (FLAGS (\Seen)) * 5 FETCH (FLAGS (\Seen)) * 6 FETCH (FLAGS (\Seen)) . . . * 2083 FETCH (FLAGS (\Seen)) * 2084 FETCH (FLAGS (\Seen)) * 2085 FETCH (FLAGS (\Seen)) * 2086 FETCH (FLAGS (\Seen)) * 2087 FETCH (FLAGS (\Seen)) * 2088 FETCH (FLAGS (\Recent)) * BYE Mailbox is in inconsistent state, please relogin. Connection closed by foreign host. These are the corresponding entries from my mail syslog during the same time period. I've included the postfix entries, as they might be relevant to the problem. Mar 31 13:55:14 myserver dovecot: imap-login: Login: user=<me>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Mar 31 13:55:33 myserver dovecot: pop3-login: Login: user=<me>, method=PLAIN, rip=xxx.xxx.xxx.xxx, lip=yyy.yyy.yyy.yyy Mar 31 13:55:35 myserver dovecot: POP3(me): Disconnected: Logged out top=0/0, retr=1/18590, del=2/2089, size=10863040 Mar 31 13:56:29 myserver postfix/smtpd[26589]: connect from unknown[79.165.160.211] Mar 31 13:56:30 myserver postfix/smtpd[26589]: 1A57E2F7E6: client=unknown[79.165.160.211] Mar 31 13:56:30 myserver postfix/cleanup[26646]: 1A57E2F7E6: message-id=<000901c89360$061afdf8$11e5c1ae@qawbud> Mar 31 13:56:35 myserver postfix/qmgr[2254]: 1A57E2F7E6: from=<amsonson(a)impsat.com.ar>, size=61232, nrcpt=1 (queue active) Mar 31 13:56:36 myserver postfix/smtpd[26651]: connect from localhost.localdomain [127.0.0.1] Mar 31 13:56:36 myserver postfix/smtpd[26651]: C98262F893: client=localhost.localdomain [127.0.0.1] Mar 31 13:56:36 myserver postfix/cleanup[26646]: C98262F893: message-id=<000901c89360$061afdf8$11e5c1ae@qawbud> Mar 31 13:56:36 myserver postfix/smtpd[26651]: disconnect from localhost.localdomain [127.0.0.1] Mar 31 13:56:36 myserver amavis[26499]: (26499-03) Passed SPAMMY, [79.165.160.211] [79.165.160.211] <amsonson(a)impsat.com.ar> -> <me(a)digitalvoice.com>, Message-ID: <000901c89360$061afdf8$11e5c1ae@qawbud>, mail_id: 47TfQi44++zM, Hits: 17.608, size: 61232, queued_as: C98262F893, 1372 ms Mar 31 13:56:36 myserver postfix/smtp[26648]: 1A57E2F7E6: to=<me(a)mydomain.com>, orig_to=<postmaster(a)digitalvoice.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=6.8, delays=5.4/0.01/0.01/1.4, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as C98262F893)Mar 31 13:56:36 myserver postfix/qmgr[2254]: C98262F893: from=<amsonson(a)impsat.com.ar>, size=62235, nrcpt=1 (queue active) Mar 31 13:56:36 myserver postfix/qmgr[2254]: 1A57E2F7E6: removed Mar 31 13:56:36 myserver postfix/local[26653]: C98262F893: to=<me(a)mydomain.com>, relay=local, delay=0.12, delays=0.1/0.01/0/0.01, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail) Mar 31 13:56:36 myserver postfix/qmgr[2254]: C98262F893: removed Mar 31 13:58:07 myserver dovecot: pop3-login: Login: user=<someone>, method=PLAIN, rip=xxx.xxx.xxx.xxx, lip=yyy.yyy.yyy.yyy Mar 31 13:58:07 myserver dovecot: POP3(someone): Disconnected: Logged out top=0/0, retr=0/0, del=0/291, size=11570114 Mar 31 14:00:58 myserver dovecot: IMAP(me): Maildir /home/me/.Maildir sync: UID inserted in the middle of mailbox (85953 > 85053, file = msg.XL7B:2,) Mar 31 14:00:58 myserver dovecot: IMAP(me): Disconnected: Mailbox is in inconsistent state, please relogin. output of dovecot -n: # /etc/dovecot.conf listen: * login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_greeting: myserver awaiting command mail_location: maildir:~/.Maildir mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postdrop master: So, now I've got two questions: 1. Is accessing a mailbox via POP3 and IMAP at the same time considered to be a Bad Thing? 2. Is having procmail drop messages directly into the directory that the IMAP process is scanning a Bad Thing? 3. Is there a better/preferred way to have Postfix/procmail deliver mail to the maildir that will keep Dovecot IMAP happy? (There don't seem to be any issues with pure POP3 access). Thanks in advance for your help, and if there's anything else you need to know that I can provide, please ask. I've tried to provide as much information up front as I can. Later, Chris

8 23

[Dovecot] Sieve extension registration
by Julian Cowley 29 Jul '08

29 Jul '08

Cool, I just happened to notice this while browsing... >From <http://www.iana.org/assignments/sieve-extensions>: Capability name: vnd.dovecot.* (anything starting with "vnd.dovecot.") Description: Extends the Sieve language with vendor-defined functionality specific to the Dovecot Secure IMAP server (http://www.dovecot.org) RFC number: Not applicable Contact address: Stephan Bosch <stephan&rename-it.nl> Timo Sirainen <tss&iki.fi> Registration Date: 2008-07-28 Any current plans for it or is it just a placeholder?

2 2

[Dovecot] Fix available for mmap on FreeBSD zfs
by Adam McDougall 29 Jul '08

29 Jul '08

Saw this just come through for 8-current, 7-stable ought to have it in a week or so. I have not encountered the problem so I would not be able to judge if this fixes it. Patch here: http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/contrib/opensolaris/uts/commo… pjd 2008-03-15 23:23:04 UTC FreeBSD src repository Modified files: sys/contrib/opensolaris/uts/common/fs/zfs zfs_vnops.c Log: Fix mmap(2) on ZFS after some changes in VM subsystem. Submitted by: alc Reported by: kris (originally) and many others Tested with: fsx MFC after: 1 week Revision Changes Path 1.28 +4 -0 src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c

2 3