- dovecot - dovecot.org

[Dovecot] SPA (NTLM) Authentication
by Neil Briscoe 03 Sep '06

03 Sep '06

Hello I have just spent a happy day (!) configuring Exim4 to accept authenticated connections from full blown Outlook clients. That works. Unfortunately, by ticking the "Use SPA" box in Outlook it now demands SPA on the POP3 server as well. The existing POP3 server doesn't support this style of authentication. I believe Dovecot will. We're already using it as an IMAP server. What I'm worried about is diverting its current view from /etc/passwd. I have an /etc/exim4/passwd file which contains three fields for the users tested so far, their name, an encrypted password, and a clear text one. Timo has already told me that the system needs access to the cleartext password (or an NTLM style password) in order to work. It would be nice if I could have the system check the /etc/exim4/passwd file and if the user wasn't there then check the /etc/passwd file - and ignore NTLM as it would normally. Regards Neil -- Neil Briscoe Adelix Ltd neil.briscoe(a)adelix.com web: www.adelix.com tel: 0845 230 9592 / fax: 0845 230 9591 / main office: 0845 230 9590 snail: The Old Post Office, Bristol Rd, Hambrook, Bristol BS16 1RY. UK. skype: stonefish001 Adelix Ltd is BS EN ISO 9001:2000 Certified (No. GB 12763) Any views expressed in this email communication are those of the individual sender, except where the sender specifically states them to be the views of a member of Adelix Ltd. Adelix Ltd. does not represent, warrant or guarantee that the integrity of this communication has been maintained nor that the communication is free of errors or interference. ------------------------------------------------------------------------------------ Scanned for viruses, spam and offensive content by CensorNet MailSafe Professional Web & E-mail Filtering from www.censornet.com

1 1

[Dovecot] Dovecot with STARTTLS
by Dovecot Mailing List 03 Sep '06

03 Sep '06

Dovecot rc7 I have Dovecot working fine with using SSL on port 995. However, if I attempt to use STARTTLS on port 110, I receive the following error message from my MUA: >>> Connecting to "192.168.0.2" (SSL/TLS) [9/1/2006 5:36:12 PM] <<< +OK Seibercom.net at your service [ISafe POP3 Proxy] STLS +OK Begin TLS negotiation now. The connection then times out. This is the only entry in the Dovecot.log: dovecot: Sep 01 17:36:52 Info: pop3-login: Disconnected: Inactivity: rip=192.168.0.4, lip=192.168.0.2, TLS handshake Does anyone have an idea what the problem might be? Thanks! -- Gerard Seibert gerard(a)seibercom.net

6 9

[Dovecot] imap fails, policy wrong?
by rob＠adeed.tele.com 02 Sep '06

02 Sep '06

up until a week or so ago, I had no problem using IMAP logging into a server running Fedora Core (I think 4 or 5 ) with dovecot 1.0. Had used squirrelmail and other mail agents using IMAP with no problem. as of 2 days ago, I get a squirrelmail error "ERROR: Connection dropped by IMAP server. Query: CAPABILITY" and turning on dovecot debugging shows the following: audit(1157176740.621:14111): avc: denied { search } for pid=9431 comm="doveco t" name="rob" dev=dm-0 ino=23560377 scontext=user_u:system_r:dovecot_t:s0 tconte xt=user_u:object_r:httpd_sys_content_t:s0 tclass=dir can someone point me in the right direction? apologies if this doesn't contain enough info, will try to get more if necesssary, thanks in advance. (incidentally, the simpler dovecot error message says it can't chdir to my $HOME or its parent, but I see no problem with perms or ownership. ) Rob Lingelbach rob(a)colorist.org

2 1

[Dovecot] Passwd-file extra-fields ...which ones
by Luis Venegas 01 Sep '06

01 Sep '06

Hi list., >From http://wiki.dovecot.org/AuthDatabase/PasswdFile I can tell there is mail and allow_nets fields. Which ones dovecot supports? In particular one for quota?? Thanks Luis Venegas

1 0

[Dovecot] DIGEST-MD5 doesn't work
by Jürgen Herz 01 Sep '06

01 Sep '06

Hi, my dovecot installation works since months and clients authenticate using CRAM-MD5. But today I got the first chance to test an client that supports DIGEST-MD5 - and it doesn't work. Because of lack of other supporting clients and servers I'm now at the point I don't know which side is to blame. The error I get after the client answers the servers challenge is "-ERR Authentication failed: Missing nonce parameter". Though I don't know how DIGEST-MD5 works I wonder about the message because the clients answer contains a nonce parameter (captured with tcpdump): YXV0aHppZD0ib3RycyIsY2hhcnNldD11dGYtOCxjbm9uY2U9IjFlOTZkYmZiZWEwZjUxNmVhZjEyYmM0NjU1M2JmZjVlIixkaWdlc3QtdXJpPSJwb3AzL25hbm8iLG5jPTAwMDAwMDAxLG5vbmNlPSJPVGpGWmhjS2FIVjZSVGMyZlRDTXJ3PT0iLHFvcD1hdXRoLHJlYWxtPSIiLHJlc3BvbnNlPTVmMTQyZWVlN2FmMWVmYTJhYWI5ZmM0ODNiOGJjOTJhLHVzZXJuYW1lPSJvdHJzIg== authzid="otrs",charset=utf-8,cnonce="1e96dbfbea0f516eaf12bc46553bff5e", digest-uri="pop3/nano",nc=00000001,nonce="OTjFZhcKaHV6RTc2fTCMrw==", qop=auth,realm="",response=5f142eee7af1efa2aab9fc483b8bc92a,username="otrs" Client is a Perl script using Net::POP3 and Authen::SASL Modules Dovecot is version 0.99.14 - I know it's old and not supported. If one tells me the bug is known and fixed in 1.0rc, then I'll think about upgrading, but I just to test I don't want to change my running system. Regards, Jürgen

1 1

[Dovecot] Stale imap processes
by Michael Bond 01 Sep '06

01 Sep '06

I read through the thread on Stale imap process and would like to chime in that I too am having the problem. The only imap user on the system is using Mail.app 2.1. The other users are using pop with thunderbird. After quiting mail.app and stopping dovecot I can still see many imap sessions opened. Over the course of the day a good number of imap process will be open and no one will be able to connect to the server via imap or pop. Typically I have to restart dovecot twice a day with the following: /etc/init.d/dovecot stop killall imap /etc/init.d/dovecot start I've narrowed it down to an imap issue. If i don't connect with imap the other users don't report any issues connecting with pop. I'm using mbox as my mail format on centos 4. I know that the default version on centos4 is .99, but it appears that people are still having issues into 1.0rc2. Could it have something to do with using mbox format? Mike. mbond(a)the-forgotten.org

1 0

[Dovecot] deliver LDA and INBOX location
by David Lee 01 Sep '06

01 Sep '06

(OS: Fedora Core 5; dovecot: 1.0 rc7) On a typical UNIX-like OS, the INBOXes are in "/var/spool/mail/" using the user identifier: so user 'fred' has INBOX "/var/spool/mail/fred". We have a well-established different convention which subdivides this, based on the last two digits of the uid: "/var/spool/mail/12/fred" (for fred's uid as something ending "[...]12"). This is working nicely with dovecot, using the new rc7 functionality: default_mail_env = mbox:%h:INBOX=/var/spool/mail/%-2.02i/%u:[...] I am now trying to get sendmail to use dovecot's "deliver" as the LDA, (following "http://wiki.dovecot.org/LDA") as a simple drop-in replacement for the normal LDA. (Actually our migration starting point is a UW-IMAP background using its 'tmail' as LDA.) 1. It seems that using "auth default {...socket listen {...}...}" is mandatory. Can someone confirm? This feels like an extra complication: is it strictly necessary in a NIS/PAM set-up? (Fair enough if so.) 2. The main problem is that, according to the log file, the delivery attempt is being made to an INBOX "/var/spool/mail//fred". That is, it seems to be ignoring the "default_mail_env" setting. Have I missed something in the wiki, or is this a bug of some sort? -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : Durham University : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. :

1 1

[Dovecot] No tcp wrappers, other ideas to help stop brute force attacks?
by David Rees 01 Sep '06

01 Sep '06

I'm looking for a way to deny access to dovecot from certain IP addresses, basically to help prevent brute force attacks on the server. Right now I'm using denyhosts which scans /var/log/secure for authentication failures which then can add an entry to /etc/hosts.deny, but since dovecot doesn't have tcp wrappers support, that doesn't do anything. It doesn't look like I can run dovecot run xinetd. Any other ideas to help protect dovecot from brute force attacks? I don't think pam can help, can it? Otherwise I need to figure out a way to have denyhosts trigger iptables rules or something, or maybe there's another application that will work? -Dave

9 15

[Dovecot] one example, just one example ...
by OpenMacNews 01 Sep '06

01 Sep '06

... of a correctly formatted QUOTA spec in/for a static userdb. That's all I'm askin' for! i've tried a bunch of variants. the most recent two: user@domain.com:{PLAIN}testpass:::::: quota=maildir:storage=4096 user@domain.com:{PLAIN}testpass:::::: maildir:storage=4096 *none* (so far ...) work to override the spec in dovecot.conf. no errors in the logs; rather, simply: dovecot: Aug 31 08:54:25 Info: auth(default): passwd-file /var/MailServer/Data/USERS/imap_user_file: Read 2 users nobody? really, nobody does this successfully? richard

2 2

[Dovecot] [Fwd: dovecot-1.0_rc7 crashes (Login process died too early) with repeated deletes from thunderbird]
by Tim Schafer 31 Aug '06

31 Aug '06

I've run this test on every permutation of poll and notify: can NOT reproduce the crash: --with-ioloop=select --with-notify=none --with-ioloop=select --with-notify=dnotify --with-ioloop=select --with-notify=inotify --with-ioloop=poll --with-notify=none --with-ioloop=poll --with-notify=dnotify --with-ioloop=poll --with-notify=inotify CAN reproduce the crash: --with-ioloop=epoll --with-notify=none --with-ioloop=epoll --with-notify=dnotify --with-ioloop=epoll --with-notify=inotify So it would seem that epoll is related some how. As IDLE only seems to work well with epoll, I'm highly interested in resolving this crash. My Linux kernel is version 2.6.14.2 glibc 2.3.6 If any other info would help, please let me know. If any other test combinations would be helpful, I will try to do them ASAP. Regards, Tim Schafer -------- Original Message -------- Subject: [Dovecot] dovecot-1.0_rc7 crashes (Login process died too early) with repeated deletes from thunderbird Date: Thu, 24 Aug 2006 15:18:56 -0700 From: Tim Schafer <tim_schafer(a)shipfsp.com> To: Dovecot Mailing List <dovecot(a)dovecot.org> I can consistently reproduce a crash in dovecot: Select 20 or more messages and copy them to a test folder. Go into that test folder and SHIFT-DEL the messages rapidly (holding down SHIFT-DEL works best) Just rapidly DELing them (even holding down DEL) doesn't do it (unless it's the Trash folder) I'm using the following namespace (in case that's relevant) namespace private { separator = . prefix = INBOX. inbox = yes } The /var/log/syslog for the session reads: Aug 24 14:58:54 hostname dovecot: Dovecot v1.0.rc7 starting up Aug 24 14:58:55 hostname slapd[7243]: conn=147 fd=9 ACCEPT from IP=127.0.0.1:41074 (IP=0.0.0.0:389) Aug 24 14:58:55 hostname slapd[7243]: conn=147 op=0 BIND dn="" method=128 Aug 24 14:58:55 hostname slapd[7243]: conn=147 op=0 RESULT tag=97 err=0 text= Aug 24 14:59:09 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:09 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:09 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:09 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:09 hostname dovecot: auth(default): master in: REQUEST^I1^I10081^I1 Aug 24 14:59:09 hostname dovecot: auth(default): master out: USER^I1^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:09 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:10 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:10 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:10 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:10 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:10 hostname dovecot: auth(default): master in: REQUEST^I2^I10082^I1 Aug 24 14:59:10 hostname dovecot: auth(default): master out: USER^I2^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:10 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:12 hostname dovecot: auth(default): client in: AUTH^I1^IPLAIN^Iservice=IMAP^Ilip=192.168.0.7^Irip=192.168.0.100 Aug 24 14:59:12 hostname dovecot: auth(default): client out: CONT^I1^I Aug 24 14:59:12 hostname dovecot: auth(default): client in: CONT^I1^IAHRdfmkerjejfkdeie Aug 24 14:59:12 hostname dovecot: auth(default): client out: OK^I1^Iuser=username Aug 24 14:59:12 hostname dovecot: auth(default): master in: REQUEST^I3^I10085^I1 Aug 24 14:59:12 hostname dovecot: auth(default): master out: USER^I3^Iusername^Isystem_user=username^Iuid=1000^Igid=100^Ihome=/home/username Aug 24 14:59:12 hostname dovecot: imap-login: Login: user=<username>, method=plain, rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname dovecot: IMAP(username): Disconnected Aug 24 14:59:14 hostname dovecot: imap-login: Disconnected: rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname last message repeated 2 times Aug 24 14:59:14 hostname dovecot: Login process died too early - shutting down Aug 24 14:59:14 hostname dovecot: imap-login: Disconnected: rip=192.168.0.100, lip=192.168.0.7 Aug 24 14:59:14 hostname slapd[7243]: conn=147 op=1 UNBIND Aug 24 14:59:14 hostname slapd[7243]: conn=147 fd=9 closed -- Regards, Tim Schafer

1 1