- dovecot - dovecot.org

[Dovecot] Security hole #4: Specific LDAP + auth cache configuration may mix up user logins
by Timo Sirainen 21 Dec '07

21 Dec '07

Somehow I doubt there are any Dovecot setups left that unknowingly have this problem, but it still counts as a security hole. The possibility to cause this problem exists in Dovecot v1.0.rc11 and later. If you use: 1. passdb ldap with settings: - auth_bind = yes - auth_bind_userdn = no - base containing %variables required for unique user identification, e.g. base = dc=%d,dc=org - pass_filter not containing all %variables required for unique user identification - pass_attrs returning user-specific settings, such as user's home directory 2. userdb prefetch 3. auth_cache_size non-zero (0 is default) If two users with the same password and same pass_filter variables log in within auth_cache_ttl seconds (1h by default), the second user may get logged in with the first user's cached pass_attrs. For example if pass_attrs contained the user's home/mail directory, this would mean that the second user will be accessing the first user's mails. You most likely would have noticed this already by wondering why logins keep failing, unless pass_filter used also some %variables that most of the time uniquely identifies the user. For example %r (remote IP address) or %n (username without domain). You can fix this by upgrading to v1.0.10 (to be released soon), or using this patch: http://hg.dovecot.org/dovecot-1.0/raw-rev/2cedab21cd6d

2 2

[Dovecot] dovecot-auth: returning incorrect maildir for user (user seeing another user's mail)
by Brendan 20 Dec '07

20 Dec '07

timo, here is an bizarre bug for you: i had (foolishly, it turns out) configured dovecot-auth to do ldap authentication binding with a prefect userdb (configs at end of message). everything worked fine, although with huge numbers of pop logins per second we started to see some pileup in the pop3-login processes as they were all waiting for ldap responses on the single ldap connection. the auth caching was never getting hit (some interaction with the prefetch, i assume), but everything worked fine. or so i thought. we had complaints from a user saying they would occasionally pop another user's mail. after much digging, it turned out that if two or more users: - were logged/logging in at the same time - had the same password - got "lucky" then one of the users would occasionally end up with the other users' homedir/maildir. it didn't happen often (maybe once every 500-1000 login attempts), but it did happen. (i ended up writing a script that would pound the pop3 server with logins and look for the wrong number of messages in the inbox. it was not easy to trigger). i'd already realized that having the auth bind do a search and return that to prefetch was a bad idea (since it used a single ldap connection) and had already built a new config that used auth binding and userdb ldap - when we switched over to that config we were unable to replicate the problem again. so, it's not an issue for us right now. i've confirmed that the ldap server never returns the wrong homedir, so it must have been getting mixed up somehow in dovecot-auth. but it did seem like something you might want to dig into a bit, as it might indicate that something could be amiss somewhere in the auth code. that the problem only occured when the users had the same password seemed truly bizarre.. sorry i can't provide more details, it was very difficult to reproduce (and i was reproducing in a production environment and couldn't turn debug up). the auth section from the poorly behaving dovecot.conf: auth default { mechanisms = plain login passdb ldap { args = /opt/dovecot-1.0.3/etc/dovecot-ldap.conf } userdb prefetch { } user = mail } the poorly behaving dovecot-ldap.conf: hosts = ldap ldap_version = 3 auth_bind = yes base = uid=%u,o=imap user_global_uid = 8 user_global_gid = 8 dn = uid=imap@dovecot,o=imap dnpass = ****** pass_filter = (&(proto=%s)(remoteip=%r)(localip=%l)(mech=%m)(pid=%p)) pass_attrs = home=userdb_home,quota=userdb_quota,nologin=nologin,reason=reason,user=user note: the ldap server does some custom processing based on the filter - the filter was the easiest way to get them passed to it. (in case that looks a little wierd :)

2 1

[Dovecot] Wiki license
by Timo Sirainen 20 Dec '07

20 Dec '07

Any suggestions as to what license to use for wiki.dovecot.org? I should have specified this a long time ago, but luckily(?) most of the content is written by me, so I don't think there are going to be problems. The main choices are: a) GNU Free Documentation License b) Creative Commons (Attribution-Share Alike?) It could also be dual-licensed to both to maximize the distribution possibilities.

4 4

[Dovecot] How to change dovecot's bounce message
by Markus Reymann 20 Dec '07

20 Dec '07

Hi, I am using the quota plugin of dovecot. Dovecot is running as LDA for postfix. When the system is running into the quota limit, the bounce message reads as follows: > Your message was automatically rejected by Dovecot Mail Delivery Agent. > The following reason was given: > Quota exceeded Can I somehow change this message, to make it more userfriendly? Postfix has a possibilty to change the bounce_template_file. Best regards, Markus

2 1

[Dovecot] Massive Dovecot auth errors too strange for me
by Rudi K. 20 Dec '07

20 Dec '07

Hello out there, im running Dovecot on "ubuntu Dapper" serving pop3 only in maildir-style, but the dove-auth-process refuses "answers" to the deliver or login-process from time to time, (several times a day), and I have no glue whats going on and why ... Debbugging password-Auth surprised me, as the transmitted password IS correct and allows an successfull authenification lots of hundreds times a day.... but suddenly runs into trouble .. here the logs ... (please take care..., I´m a newbie ;-) Dec 18 10:25:05 server dovecot: pop3-login: Disconnected: Inactivity: method=PLAIN, rip=91.9.201.219, lip=83.154.61.77 Dec 18 10:25:07 server deliver(user.yxz(a)somedom.de): User request from dovecot-auth timed out Dec 18 10:25:07 server postfix/pipe[22156]: 63861180062A7: to=<user.yxz(a)somedom.de>, relay=dovecot, delay=60, status=deferred (temporary failure) Dec 18 10:33:09 server dovecot: auth(default): ssha_verify(info(a)mydom.de): invalid SSHA base64 decode Dec 18 10:33:09 server dovecot: auth(default): cache(info(a)mydom.de,84.166.106.150): Password mismatch Dec 18 10:33:09 server dovecot: auth(default): cache(info(a)mydom.de,84.166.106.150): SSHA(1234) != '1234' Dec 18 10:33:11 server dovecot: auth(default): client out: FAIL^I56^Iuser=info(a)mydom.de Dec 18 10:33:11 server dovecot: auth(default): client out: FAIL^I57^Iuser=info(a)mydom.de root@server:~# dovecot --version 1.0.rc17 root@server:~# dovecot --build-options Build options: ioloop=poll notify=dnotify ipv6 openssl SQL drivers: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap passwd prefetch passwd-file sql static root@server:/etc/dovecot# grep -v '^ *$#.*$\?$' dovecot-ldap.conf hosts = localhost dn = cn=admin,dc=jdbit,dc=de dnpass = auth_bind = yes ldap_version = 3 base = ou=mailsystem,dc=jdbit,dc=de scope = subtree user_attrs = uid=user,userPassword=password user_filter = (&(objectClass=ekitsMailAccount)(|(uid=%u)(userAlias=%u))) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=ekitsMailAccount)(|(uid=%u)(userAlias=%u))) default_pass_scheme = SSHA user_global_uid = vmail user_global_gid = vmail root@server:~# dovecot -n # /etc/dovecot/dovecot.conf log_timestamp: %Y-%m-%d %H:%M:%S protocols: pop3 listen: mail.mydom.de disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable: /usr/lib/dovecot/pop3-login login_greeting: mail.mydom.de POP3-Server ready login_process_size: 64 login_processes_count: 64 first_valid_uid: 5000 last_valid_uid: 5000 first_valid_gid: 5000 last_valid_gid: 5000 mail_extra_groups: mail mail_location: maildir:/var/spool/dovecot/mail/%Ld/%Ln mail_executable: /usr/lib/dovecot/pop3 mail_process_size: 384 mail_plugin_dir: /usr/lib/dovecot/modules/pop3 pop3_uidl_format: %08Xu%08Xv pop3_client_workarounds: outlook-no-nuls oe-ns-eoh auth default: cache_ttl: 0 user: nobody worker_max_count: 60 passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: master: path: /var/run/dovecot/dovecot-auth-master mode: 384 user: vmail

2 1

[Dovecot] Question with versions and problem with IMAP
by Drew Weaver 20 Dec '07

20 Dec '07

General question I have is this. Recently my personal server which I receive e-mail for a domain which is just for playing with rebooted on its own and I had both an RPM version and a source version of dovecot installed on the same machine. The RPM version started first even though I had been running under the source built version up until this point (I originally found that for some reason the version centos built was missing something, maybe plugins, I don't remember now) Anyhow, the question I have is why did it insist that all of my mail was new mail? I quickly realized what the problem is, and I noticed that once I switched it back and forth between the old and new versions it properly updated the 'read vs unread' mail in IMAP, and even though dovecot was using the same configuration file with both binaries (/etc/dovecot.conf) it made such a huge difference. The reason I am asking is because I want to update my source version from 1.0.rc2 to 1.0.9 but I would really like to retain my read vs. unread mail. The RPM version in question is: 0.99.11 The problem I am facing is, today a large mailbox approx. 570M suddenly stopped working via IMAP in outlook express. (again on version 1.0.rc2) no changes have been made to the configuration for over a year. There are no errors in maillog here is the output however: Dec 18 09:49:53 mail dovecot: imap-login: Login: user=<user>, method=PLAIN, rip=client, lip=server Dec 18 09:49:53 mail dovecot: IMAP(user): Effective uid=552, gid=100 Dec 18 09:49:53 mail dovecot: IMAP(user): Loading modules from directory: /usr/local/lib/dovecot/imap Dec 18 09:49:53 mail dovecot: IMAP(user): Module loaded: /usr/local/lib/dovecot/imap/lib01_quota_plugin.so Dec 18 09:49:53 mail dovecot: IMAP(user): Module loaded: /usr/local/lib/dovecot/imap/lib02_imap_quota_plugin.so Dec 18 09:49:53 mail dovecot: IMAP(user): maildir: data=/home/user/Maildir:INDEX=/mailaux/user:CONTROL=/mailaux/user Dec 18 09:49:53 mail dovecot: IMAP(user): maildir: root=/home/user/Maildir, index=/mailaux/user, control=/mailaux/user, inbox= Dec 18 09:49:53 mail dovecot: IMAP(user): fs quota add storage dir = /home/user/Maildir Dec 18 09:49:53 mail dovecot: IMAP(user): fs quota block device = /dev/sda1 Dec 18 09:49:53 mail dovecot: IMAP(user): fs quota mount point = /home Dec 18 09:49:55 mail dovecot: IMAP(user): Disconnected: Logged out Outlook express gives its usually helpful error message: Header download for the 'Inbox' folder did not complete. Account: 'server', Server: 'server', Protocol: IMAP, Server Response: '', Port: 143, Secure(SSL): No, Error Number: 0x800C0148 Any advice on either of these issues would just be great. Happy holidays to those who are celebrating this time of year! -Drew

2 1

[Dovecot] Upgrading from 1.0.rc2-1ubuntu2.2 on edgy
by Daragh Mc Grath 20 Dec '07

20 Dec '07

Hi Guys, Can anyone shed some light as to how I upgrade away from 1.0.rc2-1ubuntu2.2 on edgy? The usual aptitude upgrades aren't doing anything for me, and, downloading the package from another Ubuntu release, and trying a dpkg -i is causing lots of dependency errors. Daragh

2 1

Re: [Dovecot] Dovecot + SASL + allow_nets
by Andrew Garner 20 Dec '07

20 Dec '07

> Timo Sirainen schreef: > > On Mon, 2007-12-03 at 14:36 +0100, Marc Cuypers wrote: > >> When using dovecot for authentication of an SASL (postfix) request, i > >> cannot use the allow_nets parameter. The IP-address of the requester is > >> not known in dovecot. > >> > >> I would like to allow sasl for certain users, others are not allowed to > >> access via SASL. > >> Some users can have access to imap and pop3 from certain IP-addresses. > >> > >> How could i combine this in then dovecot configuration? > > > > Since Postfix doesn't send the IP to Dovecot, there isn't anything on > > Dovecot's side you can do. You could try asking about this in Postfix > > list.. Someone at least had a patch which allowed sending local IP to > > Dovecot (http://marc.info/?t=119306971600010&r=1&w=2) Maybe it sends > > remote IP as well. I wrote that patch. It passes both endpoints (remote & local) through to dovecot . This lets you restrict smtp-auth just like pop3 or imap using the remote IP. In my case, I had played around with a quick hack for doing per-ip realming (using the local IP) w/ dovecot-sql.

3 4

[Dovecot] child (login) killed with signal 9
by Matt LaPlante 19 Dec '07

19 Dec '07

Hi, I'm running dovecot on an Ubuntu server (1:1.0.5-1ubuntu2). Dovecot provides pop3, imap, and sasl to postfix. The setup works quite nicely, however I do have one error that shows up repeatedly in my dovecot.log. <snip> dovecot: 2007-12-12 09:29:06 Error: child 32765 (login) killed with signal 9 dovecot: 2007-12-12 09:29:06 Error: child 18039 (login) killed with signal 9 dovecot: 2007-12-12 10:05:07 Error: child 26088 (login) killed with signal 9 dovecot: 2007-12-12 10:05:07 Error: child 5271 (login) killed with signal 9 dovecot: 2007-12-12 10:05:07 Error: child 5273 (login) killed with signal 9 <snip> I'm not aware that this is actually causing problems, but since it shows up several hundred times a day on a couple-user setup, I'm rather curious about what's causing it. Thanks, Matt

3 6

[Dovecot] maildirsize quota counting locking account?
by Daniel Watts 19 Dec '07

19 Dec '07

Hi, I've just straced a dovecot imap process and found one thread sitting there doing hundreds and hundreds of maildirsize updates as follows: > > open("/home/virtual/mydomain.com/home/admin/Maildir/maildirsize", O_RDWR|O_APPEND) = 7 > read(7, "10485760000S\n1562717408 107547\n-"..., 5120) = 2446 > read(7, "", 2674) = 0 > write(1, "* 1810 FETCH (UID 1815 RFC822.SI"..., 2031) = 2031 > setsockopt(1, SOL_TCP, TCP_CORK, [0], 4) = 0 > epoll_wait(4, {{EPOLLIN, {u32=101056896, u64=2370923004288}}}, 5, 2584) = 1 > read(0, "2838 UID fetch 1816 (UID RFC822."..., 2974) = 51 > setsockopt(1, SOL_TCP, TCP_CORK, [1], 4) = 0 > close(7) = 0 > open("/home/virtual/mydomain.com/home/admin/Maildir/maildirsize", O_RDWR|O_APPEND) = 7 > read(7, "10485760000S\n1562717408 107547\n-"..., 5120) = 2446 > read(7, "", 2674) = 0 > open("/home/virtual/mydomain.com/home/admin/Maildir/.Folders.ALERTS.Payments/cur/1195331425.M52296P11937V0000000000000807I000000001015A5EB_0.tg3,S=2079:2,Sa", O_RDONLY) = 10 > fstat(10, {st_mode=S_IFREG|0600, st_size=2079, ...}) = 0 > pread(10, "Return-Path: <apache(a)tg7.alumina"..., 4096, 0) = 2079 > pread(10, "", 2017, 2079) = 0 > pread(10, "Return-Path: <apache(a)tg7.alumina"..., 4096, 0) = 2079 > write(1, "* 1811 FETCH (UID 1816 RFC822.SI"..., 2180) = 2180 > close(10) = 0 > stat("/home/virtual/mydomain.com/home/admin/Maildir/.Folders.ALERTS.Payments/new", {st_mode=S_IFDIR|0700, st_size=6, ...}) = 0 > stat("/home/virtual/mydomain.com/home/admin/Maildir/.Folders.ALERTS.Payments/cur", {st_mode=S_IFDIR|0700, st_size=618496, ...}) = 0 > close(7) = 0 > open("/home/virtual/mydomain.com/home/admin/Maildir/maildirsize", O_RDWR|O_APPEND) = 7 > read(7, "10485760000S\n1562717408 107547\n-"..., 5120) = 2446 > read(7, "", 2674) = 0 > write(1, "2838 OK Fetch completed.\r\n", 26) = 26 > setsockopt(1, SOL_TCP, TCP_CORK, [0], 4) = 0 > epoll_wait(4, {}, 5, 800) = 0 > epoll_wait(4, {{EPOLLIN, {u32=101056896, u64=2370923004288}}}, 5, 5000) = 1 > read(0, "2839 UID fetch 1817 (UID RFC822."..., 2923) = 51 > setsockopt(1, SOL_TCP, TCP_CORK, [1], 4) = 0 > close(7) = 0 > open("/home/virtual/mydomain.com/home/admin/Maildir/maildirsize", O_RDWR|O_APPEND) = 7 During this time (at least 5-10 minutes) , I could not check the account via my email client Thunderbird. Clicking on an email would just sit there as if it is loading but nothing would happen - the read pane just remains blank. Is Dovecot going through every email (of many 10,000's) and counting up the sizes? Could this be made more efficient so it doesn't lock the account? This could I guess be a Thunderbird issue - it is a disappointingly imperfect client. Dan

4 5