- dovecot - dovecot.org

CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3223 (Bug ID) Vulnerability type: CWE-617 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notification: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11499 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Workaround: Authentication crash can be avoided if authentication is done without TLS. Solution: Operators should upgrade to a fixed version.

1 0

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting.
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3212 (Bug ID) Vulnerability type: CWE-476 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Researcher credits: Marcelo Coelho Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notificatio: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11494 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s). Workaround: There is no available workaround for this issue. Solution: Operators should upgrade to a fixed version.

1 0

Re: Sis to deduplicate attachments does not work?
by Daniel Miller 29 Apr '19

29 Apr '19

On April 23, 2019 10:54:38 PM luckydog xf <luckydogxf(a)gmail.com> wrote: > Is it worthwile to use dbox? seeing from > http://www.linuxmail.info/mbox-maildir-mail-storage-formats/ it may cause > file lock and easy to corrupt. As with everything - it depends. You're asking me so these are *my* opinions - and I do not claim to be anything more than a hobbyist/tinkerer when the comes to this. mbox has potential use for long term read-only archives - I see no reason to use it for live mailboxes. maildir is undoubtedly the least susceptible to corruption. It's also the slowest format for reading. How slow is "slow" depends on your hardware - it may be imperceptible with enough RAM and SSD's - or it may result in user complaints with large mailboxes. dbox is Dovecot's preferred format. I know Timo has put a lot of effort into it. sdbox is similar to maildir in that each mail is a separate file. mdbox significantly reduces the number of files which can make file-based backups faster. Both dbox formats are dependent on their index files. If you've got good hardware, including a proper UPS, I'd recommend dbox (my server is presently using sdbox). With large mailboxes and file-based backups you'll benefit from mdbox. When reliability is the #1 concern above anything else - use maildir. Depending on your use SIS can have significant impact on storage requirements - but storage these days is relatively cheap. I haven't seen much feedback from users actively using SIS - I'd love to hear from high traffic sites with SIS experience to know if the corruption issues have been resolved. In my case there was at least a 30% reduction in space but I had too many errors - admittedly it's been a couple years since I last tried it. -- Daniel

3 3

Using lmtp to authenticate email users
by Patrick Mahan 29 Apr '19

29 Apr '19

FreeBSD 11.2 Postfix 3.3.2 Dovecot 2.3.4 I am trying to use dovecot lmtp with postfix to verify authentication of incoming email and to avoid being a spam relay (an issue I was having using sendmail as my MTA). I am getting the following log message in /var/log/maillog: Mar 30 20:31:38 ns postfix/smtpd[40373]: NOQUEUE: reject: RCPT from mail-eopbgr750091.outbound.protection.outlook.com[40.107.75.91]: 450 4.1.1 < mahan(a)mahan.org>: Recipient address rejected: unverified address: host ns.mahan.org[private/dovecot-lmtp] said: 550 5.1.1 <mahan(a)mahan.org> User doesn't exist: mahan(a)mahan.org (in reply to RCPT TO command); from=< pmahan(a)silver-peak.com> to=<mahan(a)mahan.org> proto=ESMTP helo=< NAM02-BL2-obe.outbound.protection.outlook.com> 'mahan' does exist on ns.mahan.org. So I am confused to why lmtp is failing to find this username. Thanks, Patrick

4 5

used Lazyexpunge
by lty 28 Apr '19

28 Apr '19

I used Lazyexpunge. I tried to create .DELETED without any hints and see that the creation was successful. I want to prevent users from creating .DELETED, what should I do? My settings > plugin { > lazy_expunge = .DELETED/ > } > # > > namespace { > prefix = .DELETED/ > hidden = yes > list = no > separator = / > location = maildir:/var/vmail/backup/expunged/%d/%n > }

2 1

Auto rebuilding of Solr indexes on settings change?
by Peter Mogensen 25 Apr '19

25 Apr '19

Hi, Looking at the source, it doesn't seem like fts-solr checks for settings changes using fts_index_have_compatible_settings() like fts-lucene does. Is there any special reason for why fts-solr shouldn't also rebuild indexes if settings has changed? /Peter

2 1

msg header has bad magic value
by 김태용 25 Apr '19

25 Apr '19

There was an error saving the message. 'Error: Corrupted dbox file /storage/m.1 (around offset = 21589): msg header has bad magic value' Why do I get an error? How can I fix it?

1 0

haproxy + submission services -> postfix failure
by Chris Thomas 24 Apr '19

24 Apr '19

Hi, I have a nginx server which is using the proxy protocol to forward tcp connections to dovecot. Dovecot is configured to be a submission service for email to be sent. Then postfix should send the email itself which is also using the ha proxy protocol. There are a few moving parts in this problem so I'm not sure where the problem is. But I want to ask if somebody can validate my dovecot configuration somehow so I can start to tick off some things from the list. Sending email fails, seems to get to postfix, then die Receiving emails succeeds and I don't have any problem to pick them up. I've figured out some stuff, like lmtp shouldn't use haproxy when talking between postfix -> dovecot for receiving emails. If I enable the protocol on lmtp, I can't receive any emails at all. In order to get postfix to accept emails, I enabled haproxy protocol and enabled postscreen and then postfix could access the source ip and stop my server from being an open relay. I've got tls certificates installed on dovecot and postfix, all created by letsencrypt and I don't appear to have any problems with them. I will try to give as much information about the config as I can, I'm not sure what other parts are good to have, but let me know if you are missing something or want to check a value. >> 10-master.conf: service submission-login { inet_listener submission { port = 587 haproxy = yes } } service lmtp { inet_listener lmtp { port = 24 haproxy = no } } >> 20-submission.conf submission_relay_host = postfix.mail-server submission_relay_port = 25 submission_relay_ssl = starttls submission_relay_ssl_verify = yes Then because it might help to give the other side of the connection configuration for postfix, here is the relevant information: >> master.cf: smtp inet n - - - 1 postscreen smtpd pass - - - - - smtpd >> main.cf postscreen_upstream_proxy_protocol = haproxy postscreen_upstream_proxy_timeout = 10s That's it. I don't know what other information could be useful. There are some logs, they are like this (I've got logging turned on for pretty much every option I have: Dovecot logs: Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Effective uid=8, gid=8, home=/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: maildir++: root=/mail/__DOMAIN_COM__/__USER__, index=, indexpvt=, control=, inbox=/mail/__DOMAIN_COM__/__USER__, alt= Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Looking up IP address Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: DNS lookup successful; got 1 IPs Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connecting to 10.104.211.161:25 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Received greeting from server: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection failed: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Error: Failed to establish relay connection: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Disconnected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Info: Disconnect from __IP_ADDR_1__: Failed to establish relay connection in=0 out=22 (state=GREETING) Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Disconnected: Failed to establish relay connection Postfix Logs: postfix/postscreen[525]: warning: haproxy read: time limit exceeded If anybody could help out, I'd be grateful because I just can't see what the problem is. Chris

2 1

lmtp_save_to_detail_mailbox override
by Andreas Thienemann 24 Apr '19

24 Apr '19

Hi, I have a dovecot 2.3.2.1 instance running here that is getting userdb and passdb data from a SQL database. This was a cyrus server migrated over and all users are happy. All users except one: Said user asked if it would be possible to disable subaddressing (localuser+folder(a)example.com) again. The setting controlling that is AFAIK the lmtp_save_to_detail_mailbox item. My idea was to override that setting for the specific user. I changed the user_query to return no for the user in question and all seems well: # doveadm user test field value user test(a)example.com uid vmail gid vmail home /var/lib/imap/example.com/test mail mdbox:/var/spool/imap/user/example.com/test lmtp_save_to_detail_mailbox no # Looks good, doesn't work though. Mail is still delivered to the +folder. Is this per user setting not taken into account? I could probably provide the user in question with a sieve script that files everything into the INBOX again but I wonder if there's a better way? cheers, Andreas

3 3

pigeonhole tests crashing in deleteheader.svtest
by Michal Hlavinka 24 Apr '19

24 Apr '19

Hi, when trying to build dovecot 2.3.5.1 pigeonhole testsuite crashes in Test case: ./tests/extensions/editheader/deleteheader.svtest: 1: Test 'Deleteheader - nonexistent' SUCCEEDED 2: Test 'Deleteheader - nonexistent (match)' SUCCEEDED 3: Test 'Deleteheader - one' SUCCEEDED 4: Test 'Deleteheader - two (first)' SUCCEEDED 5: Test 'Deleteheader - two (last)' SUCCEEDED 6: Test 'Deleteheader - :index' SUCCEEDED 7: Test 'Deleteheader - :index :last' SUCCEEDED 8: Test 'Deleteheader - implicit keep' SUCCEEDED make: *** [Makefile:1190: tests/extensions/editheader/deleteheader.svtest] Segmentation fault (core dumped) Let me know if you need more debug information. Cheers Michal Hlavinka #0 0x00007f9924faea8a in __strlen_sse2 () from /lib64/libc.so.6 #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 #2 0x000055f7330916b3 in testsuite_message_set_data (mail=0x55f73486f848) at testsuite-message.c:96 #3 0x000055f7330918b9 in testsuite_message_set_file (renv=renv@entry=0x55f734856ac0, file_path=<optimized out>) at testsuite-message.c:139 #4 0x000055f7330931cc in testsuite_smtp_get (renv=renv@entry=0x55f734856ac0, index=<optimized out>) at testsuite-smtp.c:171 #5 0x000055f73309566c in cmd_test_message_smtp_operation_execute (renv=0x55f734856ac0, address=<optimized out>) at cmd-test-message.c:404 #6 0x00007f992543f371 in sieve_interpreter_operation_execute (interp=0x55f734856a68) at sieve-interpreter.c:911 #7 sieve_interpreter_continue (interp=0x55f734856a68, interrupted=0x0) at sieve-interpreter.c:949 #8 0x00007f992543f5d1 in sieve_interpreter_run (interp=0x55f734856a68, result=<optimized out>) at sieve-interpreter.c:999 #9 0x000055f73308f670 in testsuite_run (msgdata=<optimized out>, ehandler=<optimized out>, senv=0x7ffd30eacfa0, sbin=<optimized out>) at testsuite.c:73 #10 main (argc=<optimized out>, argv=<optimized out>) at testsuite.c:203 (gdb) up #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 632 dsize = strlen(src->domain) + 1; (gdb) p *src $4 = {localpart = 0x55f73480cdc8 "/tmp/dsieve-testsuite.1553794316.30960/smtp/0.eml", domain = 0x1 <error: Cannot access memory at address 0x1>}

3 5