- dovecot - dovecot.org

[Dovecot] RFE: MD5 encryption with for plain text passwords
by Felix Schwarz 23 Jul '04

23 Jul '04

Hi, due to compatibility issues with mail clients I think I have to use plain text authentication. In order to secure the passwords during their transport I'll use SSL encryption. After reading some documentation I think that I'll have to store the passwords as plain text in the authdb. That is something I dislike very much as it is a (imho) good tradition for unix to store only encrypted passwords for security reasons. I would like to see the possibility in dovecot to store the passwords for plain text authentication md5 encrypted. That should be easy to implement (just one md5 encryption before comparing the given password with the stored one) and could improve security. As this would be an api change it should be made configurable (and in the first versions this setting should default to the actual behavior). How do you like this idea? Maybe I can provide a patch but I won't work on this if you won't include it within dovecot at all. And last but not least I want to thank you for your great support! I really appreciate it! :-) -- Felix

3 2

[Dovecot] CRAM-MD5
by Felix Schwarz 23 Jul '04

23 Jul '04

Hi, after getting dovecot working with PostgreSQL and plaintext passwords I tried to use md5 encrypted passwords with mozilla. www.roughtrade.net/dovecot says that Mozilla only supports CRAM-MD5 and that CRAM-MD5 is included in HEAD. Now I have two questions: 1) Is the md5 hash stored in passdb with cram-md5 the same as in digest-md5? 2) Is a new dovecot stable build planned within the next two weeks (which includes CRAM-MD5)? (I guess the answer is no :-( 3) Are there any dovecot rpms with pgsql and CRAM-md5 supprt? -- Felix

3 3

Re: [Dovecot] Dovecot auth problem on FreeBSD 4.10
by Viren Patel 22 Jul '04

22 Jul '04

> On Thu, 2004-07-22 at 20:35, Viren Patel wrote: >> Hope this helps. Should I send the entire socket.h file? > > Hmm. What would happen if in src/lib/fdpass.c you added: > > #undef CMSG_LEN > #undef CMSG_DATA > > #define CMSG_LEN(l) (sizeof(struct cmsghdr) + (l)) > #define CMSG_DATA(cmsg) ((u_char *)(cmsg) + sizeof(struct cmsghdr)) > > Yes! This did the trick. It seems to be working fine now. Thanks for your help. I can now go on to further testing and imaps/pop3s. I am seriously looking at Dovecot for our production mail server. Viren Patel University of Texas at Austin

2 1

[Dovecot] Dovecot auth problem on FreeBSD 4.10
by Viren Patel 22 Jul '04

22 Jul '04

Hello. I am trying to setup Dovecot on an Alpha running FreeBSD 4.10. I am simply trying the imap/pop3 protocols at this time. But with both protocols the log message I get is: pop3-login: fd_send(5) failed: Bad file descriptor dovecot: child 275 (login) returned error 89 or imap-login: fd_send(5) failed: Bad file descriptor dovecot: child 275 (login) returned error 89 I have tried various combinations of: auth = default|plain|pam auth_userdb = passwd auth_passdb = passwd|shadow|pam|passwd-file but nothing works. What am I doing wrong? Thanks. Viren Patel University of Texas at Austin

5 5

[Dovecot] help: The current command did not succeed. The mail server responded: Invalid mask.
by Ivo Rütsche 22 Jul '04

22 Jul '04

on your mozilla client: go to "Edit" / "Mail & Newsgroups Account Settings" / [your account] / "Server Settings" / "Advanced..." / "IMAP" / "Other Users" make sure your text box is empty (default is "~") bye ivo

1 0

[Dovecot] One final issue
by Tom Ray [Lists] 22 Jul '04

22 Jul '04

Timo- Thanks for all the help. After I changed the permissions to the virtual user I setup I had a few small issues but was able to work through them. Now IMAP is running great. But my new question is, do I need to do anything to get it to work with POP? My server refuses to respond on 110 and I'm wondering if there is something I need to do? I was under the impression that Dovecot can handle both POP/IMAP requests. TIA Tom

3 8

[Dovecot] [PATCH] add LOGIN authentication mechanism
by Andrey Panin 22 Jul '04

22 Jul '04

Hello, attached patch (1.0-test29) adds LOGIN authentication mechanism. Tested with KMail and seems working. Please consider applying. Best regards. P.S. I also have NTLM authentication working and plan to submit it RSN. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

2 1

[Dovecot] Authentification with PostgreSQL
by Felix.Schwarz＠web.de 22 Jul '04

22 Jul '04

Hi all, I found Dag Wieers' Fedora Core 2 rpm on http://dag.wieers.com/packages/dovecot/ and installed it. Now dovecot-auth isn't complaining anymore about an unknown userdb type but I can't get authentication working. /etc/dovecot.conf (...) # Authentication process name. auth = default # plain digest-md5 anonymous auth_mechanisms = plain auth_userdb = pgsql /etc/dovecot-pgsql.conf auth_userdb = pgsql /etc/dovecot-pgsql.conf auth_user = root auth_verbose = yes (...) /etc/dovecot-pgsql.conf connect = host=localhost dbname=xams-dovecot user=dovecot password=hallo default_pass_scheme = PLAIN password_query = SELECT password FROM users WHERE username = '%u' user_query = SELECT home, uid, gid FROM users WHERE username = '%u' If I try to login over imap (no ssl) with Mozilla Mail, authentification will always fail (username: felix(a)schwarz-online.org, password: "hallo"). /var/log/syslog Jul 22 15:48:47 steinchen postgres[2057]: [30-1] DEBUG: forked new backend, pid=2198 socket=10 Jul 22 15:48:47 steinchen postgres[2198]: [31-1] DEBUG: Passwortpaket erhalten Jul 22 15:48:47 steinchen postgres[2198]: [32-1] LOG: Verbindung authorisiert: Benutzer=dovecot Datenbank=xams-dovecot (...) Jul 22 15:51:15 steinchen dovecot(pam_unix)[2210]: check pass; user unknown Jul 22 15:51:15 steinchen dovecot(pam_unix)[2210]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= /var/log/dovecot.log dovecot: Jul 22 15:48:46 Info: Dovecot starting up dovecot-auth: Jul 22 15:51:18 Info: PAM: pam_authenticate(felix(a)schwarz-online.org) failed: Authentication failure $ psql -d xams-dovecot dovecot xams-dovecot-> SELECT password FROM users WHERE username = 'felix(a)schwarz-online.org'; password ---------- hallo xams-dovecot=> SELECT home, uid, gid FROM users WHERE username = 'felix(a)schwarz-online.org'; home | uid | gid ----------+-----+----- /home/fs | 500 | 500 What is wrong? Password encryption? Is there a possibility to see what dovecot gets from Mozilla and what are the expected results of the sql queries? I am stuck as I don't know exactely why authentification failes... thanks for your help -- Felix

3 2

[Dovecot] [PATCH] POP3 CAPA command RFC violation
by Andrey Panin 22 Jul '04

22 Jul '04

Hello, looks like SASL capability reported by dovecot in response to POP3 CAPA command doesn't conforms with rfc2449 which says: Examples: C: CAPA S: +OK Capability list follows S: TOP S: USER S: SASL CRAM-MD5 KERBEROS_V4 S: RESP-CODES S: LOGIN-DELAY 900 S: PIPELINING S: EXPIRE 60 S: UIDL S: IMPLEMENTATION Shlemazle-Plotz-v302 S: . And later: The POP3 AUTH command [POP-AUTH] permits the use of [SASL] authentication mechanisms with POP3. The SASL capability indicates that the AUTH command is available and that it supports an optional base64 encoded second argument for an initial client response as described in the SASL specification. The argument to the SASL capability is a space separated list of SASL mechanisms which are supported. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Dovecot sends SASL capability as list of AUTH=FOO pairs. Looks like copy-paste from IMAP code. Patch attached. Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

1 0

[Dovecot] namespaces and behaviour of LIST and SELECT with leading ~
by Tim Southerwood 21 Jul '04

21 Jul '04

Hi One weirdness when going through the code: (We are migrating from WU-IMAP and have users with a mixture of ~/IMAP/ and ~/Mail/ for storing mail - but all user INBOX=~/.email thankfully. IMAP client config is even more random and we have 1800 users. I have been playing with namespaces to translate various prefixes ala: default_mail_env = mbox:%h/:INBOX=%h/.email:INDEX=/var/cache/dovecot/%n # Note lack of IMAP ^^^ (So clients can use ~/IMAP or ~/Mail - we have a # historic mixture) full_filesystem_access = no namespace private { separator = / inbox = yes prefix = hidden = no location = mbox:.email } namespace private { separator = / prefix = hidden = no location = mbox:IMAP/ } namespace private { separator = / prefix = IMAP/ hidden = no location = mbox:IMAP/ } namespace private { separator = / prefix = ~/IMAP/ hidden = no location = mbox:IMAP/ } User tstest has INBOX in ~/.email and mail folders in ~/IMAP/ all in mbox format: Here's a sample conversation: * OK dovecot ready. 1 login tstest ******* 1 OK Logged in. 1 list "" % * LIST (\NoInferiors \UnMarked) "/" INBOX * LIST (\NoInferiors) "/" "Trash" * LIST (\NoInferiors) "/" "Queue" * LIST (\NoInferiors) "/" "Sent" * LIST (\NoInferiors) "/" "Drafts" * LIST (\NoInferiors) "/" "Blah" 1 OK List completed. Good 1 list "" IMAP/% * LIST (\NoInferiors) "/" "IMAP/Trash" * LIST (\NoInferiors) "/" "IMAP/Queue" * LIST (\NoInferiors) "/" "IMAP/Sent" * LIST (\NoInferiors) "/" "IMAP/Drafts" * LIST (\NoInferiors) "/" "IMAP/Blah" 1 OK List completed. Good 1 list "" ~/IMAP/% 1 OK List completed. Oops (being caught by mbox_is_valid_mask as prefix begins with ~ and the client supplied prefix is being tested, not the virtual one after namespace prefix substitution) But... 1 select Blah * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.* 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1090326264] UIDs valid * OK [UIDNEXT 6] Predicted next UID 1 OK [READ-WRITE] Select completed. Yes 1 select IMAP/Blah * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.* 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1090326264] UIDs valid * OK [UIDNEXT 6] Predicted next UID 1 OK [READ-WRITE] Select completed. Yes 1 select ~/IMAP/Blah * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted.* 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1090326264] UIDs valid * OK [UIDNEXT 6] Predicted next UID 1 OK [READ-WRITE] Select completed. Oo - this works despite the ~ I would argue that with namespace {} directives, the behaviour of SELECT is correct. I would suggest that it may be better to test the final translated path thus: if full_filesystem_access = yes let anything go. else make sure that final translated mail path is identical OR a subpath of the default_mail_env mbox folder path. (INBOX is a special case and can be matched as well) This is a suggestion - what do you think? I'd have a go myself but I don't yet feel competant with the dovecot code. Best wishes Tim -- Tim J Southerwood

2 1