- dovecot - dovecot.org

PBKDF2 password hashing as in ASP.NET Core
by Yves Goergen 30 Aug '20

30 Aug '20

Hello, I'm setting up a new server and, again, seek for a decently secure (from a security specialist's POV) way to store and verify user passwords in a database. Additionally now, GDPR requires me to use a solid state-of-the-art solution. My OS is Ubuntu 20.04, Dovecot version 2.3.7, database backend with PostgreSQL 12. Obviously, storing the plaintext password is a terrible idea. SHA-based methods aren't suitable either. bcrypt has been recommended often [1]. PBKDF2 was preferred over bcrypt even more [2]. I'm managing all database contents with an ASP.NET Core application that implements the management user frontend. It's a bit hard to find bcrypt support for .NET (there are a few NuGet packages of unknown quality [3]). .NET does however implement, use and recommend PBKDF2 for its own user management. If this is by far the best way to go, I'm already covered on that side. Now the problem is, once again*, how I can use this in applications to make them as secure. I need a solution for Dovecot and Exim. Exim seems to be able to ask Dovecot (IMAP) for user authentication, so I might try that and only need to solve the problem in Dovecot alone. Dovecot documentation says that PBKDF2 is somewhat possible [4]. It requires the hash in the format "$1$salt$rounds$hash". I guess that "salt", "rounds" and "hash" are the parameters here. But what is their format? The .NET implementation [5] describes its format as "{ 0x01, prf (UInt32), iter count (UInt32), salt length (UInt32), salt, subkey }" with big-edian integers. The result is base64-encoded. Prf is an enum value, describing the HMAC SHA-256. Subkey is the hash value part. I might find a way to convert .NET's format into what Dovecot understands. The hmac is SHA-256, the rounds is 10000. But I wasn't able to get it working. My test password is: simplepassword The .NET hash: AQAAAAEAACcQAAAAEG0Anzb9vKOqsAKxLyhXedCTJoHrP381hKiKBHuPHhMdkjqW8Bks8RFOQZLssJ2grQ== The converted hash for Dovecot: $1$bQCfNv28o6qwArEvKFd50A==$10000$kyaB6z9/NYSoigR7jx4THZI6lvAZLPERTkGS7LCdoK0= I've also found the source code in Dovecot that should verify the hash [6]. It gives some more hints about the expected format that are sadly missing from the documentation, making it almost useless. I also tried with the "{PBKDF2}" prefix, with the base64 padding "=" removed and with the hash part converted from base64 to hex. Nothing works. The source mentions "SHA1" somewhere. Is that all it can accept? No up-to-date SHA-256? So what have I done wrong here? Why can't I authenticate? The Dovecot log isn't helpful, it doesn't even mention the user name I tried to log in with from Thunderbird, most of the time (it's unpredictable). What is the correct usage of Dovecot's PBKDF2 feature? Is it functional at all? There's a test case for it [7] but that's not helpful to me. If Dovecot's PBKDF2 support is not functional or not compatible with ASP.NET Core's parameters, what options do I have? Can I build my own authentication service that Dovecot can communicate with, to fill the gap of missing crypto support? Yves *) During my research today, I find myself finding my own questions from 6 years ago when I did this the last time. The situation hasn't changed much since then. Secure password hashing is still impossible or complicated in server applications like Exim or Dovecot. [1] https://codahale.com/how-to-safely-store-a-password/ (linked from the Dovecot documentation) [2] https://www.reddit.com/r/node/comments/4u1jcn/is_bcrypt_the_best_possible_p… [3] https://nugetmusthaves.com/Tag/bcrypt [4] https://doc.dovecot.org/configuration_manual/authentication/password_scheme… [5] https://github.com/dotnet/AspNetCore/blob/master/src/Identity/Extensions.Co… [6] https://github.com/dovecot/core/blob/81b5b188c478ec36bea8bda8fcad1e5f32ac61… [7] https://github.com/dovecot/core/blob/ff5305136ae747867b6f6af9a1737188ae7b3b…

2 4

moving /var/vmail/vmail1 Maildir tree to another partition?
by Voytek Eymont 30 Aug '20

30 Aug '20

I have a small Postfix/Dovecot/MariaDB on Centos 7 with a dozen virtual domains, I'm running out of space in /var but got space can I simply move the entire /var/vmail/vmail1 tree elsewhere ? like say /vmail/vmail1 is it as simple as shutting Dovecot/Postfix, move tree, edit conf and re start ? or am I missing something ..? or is the a better way of doing this ? # grep 'var/vmail' *.conf dovecot.conf: sieve_global_dir = /var/vmail/sieve dovecot.conf: sieve_global_path = /var/vmail/sieve/dovecot.sieve dovecot.conf:# location = maildir:/var/vmail/public/:CONTROL=~/Maildir/public:INDEX=~/Maildir/public # cd ../postfix # grep 'var/vmail' *.cf main.cf:virtual_mailbox_base = /var/vmail # dovecot --version 2.3.11.3 (502c39af9)

2 1

Rsync the dovecot repo
by Marc Roos 30 Aug '20

30 Aug '20

Is it possible to rsync some repo that has centos7 2.3.11? http://repo.dovecot.org/ce-2.3-latest/centos/7/RPMS/x86_64/2.3.11.3-3_ce/

2 1

Imaptest stalls when removing msgs argument
by Marc Roos 30 Aug '20

30 Aug '20

I have had this imaptest[1] stall. I compared this command with what you have on the website and I was a bit surprised that what is on the website is working. What I have noticed is that if you remove this msgs argument, the imaptest stalls. I am not sure if this is according to design, but one might expect that specifying a secs, makes specifying msgs redundant? [1] imaptest - append=100,0 logout=0 host=xx.local port=143 user=xxx pass=xxx seed=100 secs=240 clients=1 mbox=64kb.mbox box=inbox/test. [2] https://doc.dovecot.org/admin_manual/sample_tests/ Using: dovecot-imaptest-2.3.10-2.x86_64

1 0

lazy_expunge and fts_autoindex
by Gregory Heytings 29 Aug '20

29 Aug '20

Hi list, I have both lazy_expunge and fts_autoindex activated (with fts-xapian), as follows: plugin { lazy_expunge = EXPUNGED/ } plugin { fts = xapian fts_xapian = partial=2 full=20 attachments=1 verbose=0 fts_autoindex = yes fts_enforced = yes fts_autoindex_exclude = EXPUNGED fts_autoindex_exclude2 = EXPUNGED/* } However, I still see "indexer-worker...: Info: Indexed 1 messages in EXPUNGED/..." in the dovecot log each time I expunge an email. I tried various other settings for "fts_autoindex_exclude" (EXPUNGED alone, EXPUNGED + EXPUNGED/ + EXPUNGED/*, ...), but none of them seem to work. Thanks for your help, Gregory

2 2

Expuning & Purging doesn't fully remove emails?
by Zelic Bojan 27 Aug '20

27 Aug '20

Hello, I'm facing an issue where deleted emails keep re-appearing after my mailbox index gets recreated. I'm running version 2.2.36 of dovecot, but I tested the same scenario under 2.3.10. I'm also using mdbox, autoexpunge, and using dovecot replication. I've had several instances now where some expunged emails show up again in a mailbox. I noticed this error: doveadm: Error: Corrupted dbox file /var/mail/virtual/mailbox(a)domain.com/mdbox/storage/m.3228 (around offset=1988744): msg header has bad magic value which caused the index to get rebuilt... however several times now, the indexes got rebuilt even though there doesnt seem like there was any error... so im not sure why that is. lmtp(13910): Warning: fscking index file /var/mail/virtual/mailbox(a)domain/mdbox/storage/dovecot.map.index lmtp(13910): Warning: fscking index file /var/mail/virtual/mailbox(a)domain/mdbox/storage/dovecot.map.index lmtp(13910): Warning: mdbox /var/mail/virtual/mailbox@domain/mdbox/storage: rebuilding indexes I'm not sure why these mails keep coming back though... or if there's anything that I can do to limit the number of emails that get restored. I want to make sure expunged & purged emails stay expunged & purged. If I run a purge and then force index recreation... why would expunged emails come back? Shouldn't I expect them all to be deleted & purged? Does expunge not expunge all emails? (In production, I'm running autoexpunge but this test below shows what happens when I attempt to expunge everything) doveadm search -u email@domain all | wc -l # output 22096 doveadm expunge -u email@domain mailbox '*' all doveadm search -u email@domain all | wc -l # output: 0 doveadm purge -u email@domain doveadm dump /var/mail/virtual/email@domain/mdbox/storage/ | grep -c 'ref.*\b0\b' # output: 0 doveadm force-resync -u email@domain Inbox # output: # doveadm(email@domain): Warning: fscking index file /var/mail/virtual/email(a)domain/mdbox/storage/dovecot.map.index # doveadm(email@domain): Warning: mdbox /var/mail/virtual/email@domain/mdbox/storage: rebuilding indexes # doveadm(email@domain): Warning: fscking index file /var/mail/virtual/email(a)domain/mdbox/storage/dovecot.map.index doveadm search -u email@domain all | wc -l # output: 843 I would expect the output to be 0. Theoretically I deleted all emails and purged all emails. Nothing should be left on the disk? However... I can see there are still m.* files in mdbox/storage for the mailbox. Overall, I'm not sure why the index got recreated... but I'm trying to limit the impact of mailbox corruption so that deleted emails do not come back if the index is somehow recreated again. If I were to re-run expunge, purge, and force-resync a 2nd time... it does get emptied out, but I'm not looking to run force-resync intentially since it causes dataloss with mdbox, and re-running only expunge & purge doesn't seem to do anything. Bojan Zelic Sr. IT Infrastructure Engineer

2 3

when are these conf.ext files loaded
by Marc Roos 27 Aug '20

27 Aug '20

Are these .conf.ext always loaded? Or only when they are configured somewhere else?

2 3

Environment variable in config
by Marc Roos 26 Aug '20

26 Aug '20

I am getting errors addressing environment variables. Are they supposed to work in such sections. Not really clear from this[1] page. service health-check { # example health-check. executable = script -p /bin/health-check.sh inet_listener health-check { port = env:PORT0 } } [1] https://doc.dovecot.org/configuration_manual/config_file/config_variables/

1 0

userdb_mail_crypt_private_password: unknown variable after upgrading Dovecot
by f_ckmail＠web.de 26 Aug '20

26 Aug '20

1 0

Dovecot 2.3.11.4 - Centos 6&7 packages
by Aki Tuomi 26 Aug '20

26 Aug '20

Hi! We have pushed new versions for these packages that now support tcpwrappers. They were inadvertendly left out from last time, but now they have been restored. Sorry for the inconvenience. Regards, Aki Tuomi Open-Xchange oy

2 1