- dovecot - dovecot.org

[Dovecot] Security hole #6: Some passdbs allowed users to log in without a valid password
by Timo Sirainen 09 Mar '08

09 Mar '08

This affects only blocking passdbs: - MySQL - PAM, passwd and shadow if blocking=yes The underlying bug exists in all v1.0.x versions, but I couldn't figure out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2. Probably a good idea to upgrade in any case. The main problem is that Dovecot's internal protocols use TAB character as a delimiter, but passwords were sent unescaped through them. So passwords containing TAB characters allowed to add new internal fields. The main problem here is a new "skip_password_check" field added in v1.0.11 to fix problems with master user logins. Specifying this field allowed the user to skip the password check, as the name implies. This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure there are no more escaping problems with any fields, but it can be also fixed with a less intrusive patch for v1.0: http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e

1 0

[Dovecot] Quota Problem?
by Michel Vega Fuenzalida 08 Mar '08

08 Mar '08

Good list I am not very good with English. I use dovecot-1.0-1.2.rc15.el5.x86_64rpm for Centos 5.1, Maildir like mailbox and I have it configured as it continues: base_dir = /var/run/dovecot/ protocols = imaps pop3s imap mail_location = maildir:~/Maildir protocol imap { mail_plugins = quota imap_quota mail_plugin_dir = /usr/lib/dovecot/imap } protocol pop3 { pop3_uidl_format = %08Xu%08Xv mail_plugins = quota mail_plugin_dir = /usr/lib/dovecot/pop3 } log_path = /var/log/dovecot.log log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail auth default { mechanisms = plain #login digest-md5 cram-md5 passdb pam { } userdb passwd { } user = root } plugin { quota = maildir quota = maildir:ignore=Trash } the problem resides in the quota, when I make: #du - sh /home/muti/Maildir/ 160M /home/michelvf/Maildir/ And in the file /home/muti/Maildir/maildirsize appears: 204800000S 138594655 4180 This doesn't belong together with the real size of the mailbox. That is to say that it is not real, is this normal? or I have not well configured dovecot.conf, I really want that through the file maildirsize, to have control of the quota. Greetings -- Usemos el Software Libre "Con todos y para el bien de todos." Jose Marti, 26 de noviembre de 1891, Tampa. Michel Vega Fuenzalida. Usuario Linux: 353763 (http://counter.li.org) Coordinador Grupo: Linux-Pinero. Administrador de Red. ELAM "Clara Zetkin" Teléfono: 53 (01) 52193107 ext 115. Isla de la Juventud. Cuba.

2 1

[Dovecot] IPv6-enabled dovecot-1.1rc* does not accept IPv4-connections
by Bernhard Schmidt 08 Mar '08

08 Mar '08

Hi, I'm having a really really strange problem. After upgrading from 1.1.beta13 to 1.1.rc2 (happened with rc1 as well IIRC) I can't connect to the services using IPv4 anymore. dovecot happily binds to the IPv6 wildcard socket which should accept IPv4 connections as well. root@vs02:~# netstat -lnp --tcp | grep dovecot tcp6 0 0 :::993 :::* LISTEN 30758/dovecot tcp6 0 0 :::995 :::* LISTEN 30758/dovecot tcp6 0 0 :::110 :::* LISTEN 30758/dovecot tcp6 0 0 :::143 :::* LISTEN 30758/dovecot root@vs02:~# telnet ::1 110 Trying ::1... Connected to ::1. Escape character is '^]'. +OK Dovecot ready. quit +OK Logging out Connection closed by foreign host. root@vs02:~# telnet 127.0.0.1 110 Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused root@vs02:~# /sbin/stop dovecot dovecot (stop) running, process 30758 dovecot (stop) pre-stop, (main) process 30758 dovecot (stop) stopping, process 30758 dovecot (stop) killed, process 30758 dovecot (stop) post-stop dovecot (stop) waiting # downgrading root@vs02:~# dpkg -i dovecot_1.1.beta13-1_amd64.deb dpkg - warning: downgrading dovecot from 1.1.rc2-1 to 1.1.beta13-1. (Reading database ... 20504 files and directories currently installed.) Preparing to replace dovecot 1.1.rc2-1 (using dovecot_1.1.beta13-1_amd64.deb) ... Unpacking replacement dovecot ... Setting up dovecot (1.1.beta13-1) ... Installing new version of config file /etc/dovecot/dovecot-sql-example.conf ... Installing new version of config file /etc/dovecot/dovecot-ldap-example.conf ... Installing new version of config file /etc/dovecot/dovecot-example.conf ... root@vs02:~# /sbin/start dovecot dovecot (start) waiting dovecot (start) starting dovecot (start) pre-start, process 30816 dovecot (start) spawned, process 30818 dovecot (start) post-start, (main) process 30818 dovecot (start) running, process 30818 root@vs02:~# netstat -lnp --tcp | grep dovecot tcp6 0 0 :::993 :::* LISTEN 30818/dovecot tcp6 0 0 :::995 :::* LISTEN 30818/dovecot tcp6 0 0 :::110 :::* LISTEN 30818/dovecot tcp6 0 0 :::143 :::* LISTEN 30818/dovecot root@vs02:~# telnet 127.0.0.1 110 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. +OK Dovecot ready. quit +OK Logging out Connection closed by foreign host. I built the packages myself, both (beta13 and rc2) with the options --without-passwd --without-passwd-file --without-shadow --without-pam --without-gssapi --without-vpopmail --with-ldap --without-checkpassword --without-nss --with-deliver --with-ioloop=epoll --with-storages=maildir,raw --sysconfdir=/etc/dovecot Anyone having an idea? Thanks, Bernhard

2 4

[Dovecot] dovecotpw
by Brent Clark 08 Mar '08

08 Mar '08

Hi I would like to simulate dovecot's dovecotpw with a perl script I tried / used use Crypt::SaltedHash; my $csh = Crypt::SaltedHash->new(algorithm => 'SHA-1'); $csh->add($passwd_string); my $salted = $csh->generate; also use Digest::SHA1; use MIME::Base64; $ctx = Digest::SHA1->new; $ctx->add($passwd_string); $ctx->add('salt'); my $salted = '{SSHA}' . encode_base64($ctx->digest . 'salt' ,''); But it doesnt work. Basically what im doing is authenticating against a mysql db. If i do a dovecotpw -s SSHA -p password and update the DB, then the mail client authenticates perfectly. If anyone can help, it would be most appreciated. Kind Regards Brent Clark

2 3

[Dovecot] dovecot and ldap config - getting no password in reply
by Joseph Norris 08 Mar '08

08 Mar '08

I almost go this liked but then I get the following: Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): pass search: base=ou=People,dc=ucmerced,dc=edu scope=subtree filter=(&(uid=jnorris)) fields=uid,userPassword Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): result: uid(user)=jnorris Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): No password in reply Mar 7 18:09:45 malaga dovecot: auth(default): client out: FAIL 2 user=jnorris temp What am I missing in my conf files? -- Cell: 209.201.3410 Desk: 209.228.4576 email: jnorris(a)ucmerced.edu #Joseph Norris (Linux/Apache/Mysql/Perl - what else is there?) print @c=map chr $_+100,(6,17,15,16,-68,-3,10,11, 16,4,1, 14,-68,12,1,14,8, -68,4,-3,-1,7,1,14,-68, -26,11,15,1,12, 4,-68,-22,11,14,14,5,15,-90);

3 2

[Dovecot] User another userdb to sasl
by Nicolas Letellier 08 Mar '08

08 Mar '08

Hello, I use Dovecot 1.0.12 with Postfix on FreeBSD. It works perfectly, but I have a question. My users are virtual (stocked in a MySQL database). I use SASL Dovecot authentification, and SASL uses my userdb (for POP/IMAP access). However, I would like my users have an other login/password to send email with SMTP/SASL. Or, I don't want my users use the same login/password for POP/IMAP than SMTP. More, I don't want some users could send emails with their login/password, but I want they can fetch their mails. I'm looking for an option in my dovecot.conf to specifie a table SQL for SASL authentification (and don't use same table SQL than IMAP/POP access). How I could do for this problem? Do you have an idea? Or, simply, is it possible with Dovecot SASL? I read all Dovecot wiki, with no results... Thanks very much. Nicolas

4 3

[Dovecot] limit numbers of fails logins
by Federico Nan 07 Mar '08

07 Mar '08

Hi!! i want to limit the retry of the login process if the password dosent match. i use dovecot gssapi login plugin. if a user put your password wrong twice, i want dovecot ban that user for a while o something like that, its that possible?? thanks a lot!!! sorry my english! -- Federico Nan Nantec.net federico(a)nantec.net

2 1

[Dovecot] Can't load private key file
by adamsh＠fsfa.org 07 Mar '08

07 Mar '08

Hi Guys, I have just purchased and installed an authenticated certificate for the mail server, but I am getting errors from dovecot. My mail.err file is showing the following. Mar 7 17:56:04 mailserver dovecot: pop3-login: Can't load private key file /etc/ssl/mailserver/mail.mydomain.tld.key: error:0906A068:PEM routines:PEM_do_header:bad password read My dovecot.conf has the following set. # Uncomment these if using SSL ssl_cert_file = /etc/ssl/mailserver/mail.mydomain.tld.crt ssl_key_file = /etc/ssl/mailserver/mail.mydomain.tld.key #ssl_key_password = #ssl_ca_file = /etc/ssl/mailserver/ca/mydomain.pem #ssl_verify_client_cert = yes ssl_parameters_regenerate = 168 verbose_ssl = no I have been playing about with it all for about 3 hours now and would greatly appreciate any help ;) Regards Adam -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1

[Dovecot] Building Dovecot with OpenLDAP break PAM LDAP on Solaris
by Laurent Blume 07 Mar '08

07 Mar '08

Hi all, I'm back with more data on a problem Iposted about one month ago. To sum it up, my Solaris 10 box has local accounts as well as LDAP ones via PAM. They work well as-is, with no special configuratio, for WU IMAP (using the «other» entry in pam.conf. When I tried a self-built Dovecot, all accounts were authenticated without problem. Then I tried the Blastwave version, same release, but with more option, and this one didn't work with the exact same configuration: local accounts were authenticated, not the PAM LDAP ones. Now, it turns out that when Dovecot is built using OpenLDAP, then PAM LDAP account won't work. If it's built with Solaris LDAP, they work, everything else being equal. Is there any way to fix that? There's the Blastwave bug report with more details if needed: http://www.blastwave.org/mantis/view_bug_page.php?f_id=0002760 Thanks in advance for any help, Laurent -- / Leader de Projet & Communauté | I'm working, but not speaking for \ G11N http://fr.opensolaris.org | Bull Services http://www.bull.com / FOSUG http://guses.org |

2 2

[Dovecot] Squat Indexing
by Jeff Grossman 07 Mar '08

07 Mar '08

I tried Squat indexing on my very small home system and when I did a body search in Thunderbird, I got a TON, and I mean TON, of these messages in my log file: Mar 6 06:13:31 apple dovecot: child 14142 (imap) killed with signal 6 Mar 6 06:13:31 apple dovecot: IMAP(jeff): file file-lock.c: line 112: unreached Mar 6 06:13:31 apple dovecot: IMAP(jeff): Raw backtrace: imap [0x482771] -> imap [0x482166] -> imap [0x484d86] -> imap(file_wait_lock+0x35) [0x484ef5] -> /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so [0x2b4664a69a0c] -> /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so [0x2b4664a6a99b] -> /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so(squat_trie_get_last_uid+0x4c) [0x2b4664a6ac1c] -> /usr/local/lib/dovecot/imap/lib20_fts_plugin.so [0x2b4664862d0b] -> /usr/local/lib/dovecot/imap/lib20_fts_plugin.so [0x2b4664863bb3] -> imap(cmd_search+0xd9) [0x41b909] -> imap(cmd_uid+0x52) [0x41ca12] -> imap [0x41d348] -> imap [0x41d3e9] -> imap [0x41db5f] -> imap(client_input+0x5f) [0x41dd8f] -> imap(io_loop_handler_run+0xf8) [0x4894c8] -> imap(io_loop_run+0x1d) [0x4887ad] -> imap(main+0x3c2) [0x424f52] -> /lib/libc.so.6(__libc_start_main+0xf4) [0x2b466451e1c4] -> imap [0x417df9] This is with version 1.1rc1. Here is a copy of my dovecot -n: # 1.1.rc1: /usr/local/etc/dovecot.conf base_dir: /var/run/dovecot/ log_timestamp: %Y-%m-%d %H:%M:%S protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/ssl/certs/stikman-godaddy.crt ssl_key_file: /etc/ssl/private/stikman-godaddy.key disable_plaintext_auth: no login_dir: /var/run/dovecot//login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login verbose_proctitle: yes mail_extra_groups: mail mail_location: maildir:~/Maildir dotlock_use_excl: no fsync_disable: yes lock_method: dotlock maildir_copy_with_hardlinks: no mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugins(default): fts fts_squat mail_plugins(imap): fts fts_squat mail_plugins(pop3): mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd plugin: fts: squat

2 2