- dovecot - dovecot.org

Different passdb backends for different services
by lists＠mlserv.org 05 Sep '19

05 Sep '19

Hi, as Dovecot supports submission, which is the sending direction, I am interested to know, if I can configure a separate passdb backend just for submission. I habe LDAP attributes that differ sending or receiving permissions. It would be nice, if I had a second passdb backend just for submission, which has a LDAP filter for locking this service. Example for IMAP, POP3, Sieve: (&(mail=%s)(mailAllowIncoming=TRUE)) Example for Submission: (&(mail=%s)(mailAllowOutgoing=TRUE)) Use case is to lock compromised accounts that send spam. An operator can notify the account owner by placing a warning messegae into his/her mailbox. Is this possible? Thanks in advance Christian

3 9

Global ACL in SQL or LDAP possible?
by lists＠mlserv.org 04 Sep '19

04 Sep '19

Hi, Can global ACLs for public folders be stored in SQL or LDAP instead of a dovecot-acl file? I could only find something for shared folders, but not for public folders? Thanks in advance Christian

1 1

Server administration
by Aleksandr Mette 04 Sep '19

04 Sep '19

Dear Sirs, There is Postfix+Dovecot+Sogo installation in our company. I have attentively red Installation and Configuration Guide. However, I could not find some information. Could you give me an advise how to: 1. Add/remove e-mail address 2. Change user e-mail address password 3. Add user e-mail address into mail alias 4. Forward e-mail 5. List all users e-mails What is the best GUI interface for Dovecot administration? With kind regards, Alex

9 14

How are imap images supposed to be stored
by d.gentner＠m4ever.de 04 Sep '19

04 Sep '19

Hello. This is a question about the imap protocol, since I am having a hard time finding these things out, so I hope you guys can help me. We are using Dovecot to receive mails and having an issue with Thunderbird. Basically, we are running into this bug with a lot of people: https://bugzilla.mozilla.org/show_bug.cgi?id=216308. <https://bugzilla.mozilla.org/show_bug.cgi?id=216308> The gist of it is, that sometimes, when there is an image linked with the imap:// protocol in the mail, then Thunderbird wants to subscribe to the folder that contains this mail, but fails. If I pull the mail off the server, it also has that link in the raw mail. However, most mails store the images as a base64 code block. I have actually seen mails getting changed over night, from imap:// links to base64 code blocks, but I can't reproduce that. All computers are supposed to have the same Thunderbird version and they do. My questions right now are: * Speaking about the general imap/mail protocol, do mails store images as base64 or imap:// links. What is the standard here? * Is there anything we can do to prevent Thunderbird from running into this bug? We are using Dovecot 2.2.36.4 * What can cause an email getting changed over night or getting synced back with the base64 blocks? It was already read, when we ran into the issue. With best regards, Domeniko Gentner

2 1

Mailcrypt plugin private password
by info＠unkn0wn3d.com 04 Sep '19

04 Sep '19

Hello there, is there a way to make the mailcrypt plugin use the user's password or at least store it in a hashed value? I'm using a passwd file for authentication. I feel uncomfortable saving the private password in plaintext in that file. Regards

2 5

plugin for IMAP protocol to modifie any email
by Matthew Brown 04 Sep '19

04 Sep '19

is there a plugin or anyway I can modifie any email content ? I would like to change body text, headers, attachments

3 3

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole
by Aki Tuomi 04 Sep '19

04 Sep '19

Dear subscribers, we have been made aware of critical vulnerability in Dovecot and Pigeonhole. --- Open-Xchange Security Advisory 2019-08-14 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3278 Vulnerability type: Improper input validation (CWE-20) Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4 Vulnerable component: IMAP and ManageSieve protocol parsers (before and after login) Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.7.2, 2.2.36.4 Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania Vendor notification: 2019-04-13 Solution date: 2019-06-05 Public disclosure: 2019-08-28 CVE reference: CVE-2019-11500 CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs. Steps to reproduce: This bug is best observed using valgrind to see the out of bounds read with following snippet: perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc localhost 143 Solution: Operators should update to the latest Patch Release. There is no workaround for the issue. --- Aki Tuomi Open-Xchange oy

8 14

Dovecot and Apple's Mail.app not playing nicely?
by Coy Hile 03 Sep '19

03 Sep '19

Hi all, Is there anything cute one has to take into account when using Dovecot with users of Apple’s Mail.app? Behavior I’m seeing is that if I delete or move messages via Webmail (Roundcube, Horde, or even ActiveSync via Mail.app on my phone), they do get moved or deleted. However, if I take the same actions in the desktop mail client, when logging in to the Webmail (or phone) app, I see the messages still seeming to be in the Inbox. Is this known behavior? A peculiarity in Apple Mail? -- Coy Hile coy.hile(a)coyhile.com

4 5

Re: Re: Quota count and clone questions
by Bratislav ILIC 03 Sep '19

03 Sep '19

Hi, I presume you figured this out after all this time, but in any case. Since quota_clone is not cumulative, it always inserts new record with actual quota, to be able to get correct results in postfixadmin one must: DROP TRIGGER mergequota2 ON quota2; And to prevent ERROR: duplicate key value violates unique constraint "quota2_pkey": CREATE FUNCTION public.clone_quota2() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN UPDATE quota2 SET bytes = NEW.bytes, messages = NEW.messages WHERE username = NEW.username; IF found THEN RETURN NULL; ELSE RETURN NEW; END IF; END; $$; And then: CREATE TRIGGER clonequota2 BEFORE INSERT ON quota2 FOR EACH ROW EXECUTE PROCEDURE public.clone_quota2() ; And finally just put: quota_clone_dict = proxy::sqlquota Hope this helps somebody trying to figure out this too. > I figured out that I can't just drop maintaining quota2 if I want > postfixadmin to report the quota status. > > I also figured out a way to run a test on my config guesses. I will try > to fit it in today, or tomorrow. But any advise to the questions below > are welcomed! > >>On 2/13/19 8:53 PM, Robert Moskowitz via dovecot wrote: >> all this almost reads like I can drop maintaining the quota2 table? >> >> From https://wiki.dovecot.org/Quota/Count >> >> mailbox_list_index = yes >> # Avoid spending excessive time waiting for the quota calculation to >> finish when >> # mails' vsizes aren't already cached. If this many mails are opened, >> finish the >> # quota calculation on background in indexer-worker process. Mail >> deliveries will >> # be assumed to succeed, and explicit quota lookups will return >> internal error. >> mail_vsize_bg_after_count = 100 >> >> seems to belong in 10-mail.conf. That is where those var are shown. >> >> But: >> >> >> plugin { >> # 10MB quota limit >> quota = count:User quota >> quota_rule = *:storage=10M >> >> # This is required - it uses "virtual sizes" rather than "physical >> sizes" for quota counting: >> quota_vsizes = yes >> } >> >> I am having problems with. Right now for quota I have: >> >> plugin { >> quota = dict:user::proxy::sqlquota >> trash = /etc/dovecot/dovecot-trash.conf.ext >> } >> >> How do I reconcile these two? >> >> Then for clone: https://wiki.dovecot.org/Plugins/QuotaClone >> >> how does: >> >> mail_plugins = $mail_plugins quota quota_clone >> plugin { >> quota_clone_dict = redis:host=127.0.0.1:port=6379 >> } >> >> get replaced with something for mysql? >> >> dovecot-sql.conf.ext: >> >> driver = mysql >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> default_pass_scheme = $cryptsha-CRYPT >> # following should all be on one line. >> password_query = SELECT username as user, password, >> concat('/home/vmail/', maildir) as userdb_home, >> concat('maildir:/home/vmail/', maildir) as userdb_mail, 101 as >> userdb_uid, 12 as userdb_gid FROM mailbox WHERE username = '%u' AND >> active = '1' >> # following should all be on one line >> user_query = SELECT concat('/home/vmail/', maildir) as home, >> concat('maildir:/home/vmail/', maildir) as mail, 101 AS uid, 12 AS >> gid, CONCAT('*:messages=30000:bytes=', quota) as quota_rule FROM >> mailbox WHERE username = '%u' AND active = '1' >> >> and >> >> dovecot-dict-sql.conf.ext: >> >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> map { >> pattern = priv/quota/storage >> table = quota2 >> username_field = username >> value_field = bytes >> } >> map { >> pattern = priv/quota/messages >> table = quota2 >> username_field = username >> value_field = messages >> } >> >> >> >> thanks

1 0

Dovecot 2.3.7 - char "-" missing
by Domenico Pastore 03 Sep '19

03 Sep '19

Hello, i have update dovecot from version 2.2.15 to 2.3.7.2. I have a problem with mine java software because there is a different response when open connection to doveadm. I need open socket to doveadm for get imap quota of a mailbox. With version 2.2.15: # telnet 192.160.10.4 924 Trying 192.160.10.4... Connected to 192.160.10.4. Escape character is '^]'. - With version 2.3.7.2: # telnet 192.160.10.3 924 Trying 192.160.10.3... Connected to 192.160.10.3. Escape character is '^]'. The difference is "-" character. The version 2.3.7 not respond with "-" character after opening the connection. Is it possible to add the character again with a parameter? Why did doveadm's answer change? Br Domenico

3 2