- dovecot - dovecot.org

system wakeup caused by write operations to /var/lib/dovecot/instances
by Tijl 07 Feb '19

07 Feb '19

Hi, I hope someone can help me with this. Problem Dovecot writes to _/var/lib/dovecot/instances_ 1 up to 3 times a day, causing the system to wake up and disks to spin up. Details content of /var/lib/dovecot/instances : 1549073010 dovecot /var/run/dovecot /etc/dovecot/dovecot.conf --> only the timestamp is changed (to current time) when dovecot writes to this file --> during write the file is temporary renamed to _instances.lock_ dovecot running processes: dovecot (main process) --> it's this process that writes to /var/lib/instances dovecot/anvil dovecot/log dovecot/config --> sometimes this process is not running, but doesn't change anything note: no clients connected problem also occur in the middle of the night (no human activity, client devices powered off, all external traffic blocked) the writings occur around every 8 hours, but vary, sometimes it's 6 hours up to 13 hours. Configuration See attachment: doveconfig-short-[platform].txt (output of _"/usr/sbin/dovecot -n"_) doveconfig-long-[platform].txt (output of _"/usr/bin/doveconf"_) --> _3-docker_ config is the most simple setup of the 3 Environment Tested on 3 platforms Platform 1: Intel Atom C2538 (Synology DiskStation 415+) Linux version 3.10.105 Dovecot version 2.2.19 (Synology MailPlus Server) Platform 2: ARMv7 rev 1 (Synology DiskStation 215j) Linux version 3.2.40 Dovecot version 2.2.19 (Synology Mail Server) Platform 3: Intel Atom C2538 (Docker container) Linux version 3.10.105 Dovecot version 2.3.2.1 (0719df592) How can dovecot be run without writing to /var/lib/dovecot/instances everyday? Is there a configuration setting for this? Thanks already! Tijl

3 4

Dovecot v2.2.36.1 released
by Aki Tuomi 07 Feb '19

07 Feb '19

https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart --- Aki Tuomi Open-Xchange Oy

11 13

alterstorage for archiv
by Maciej Milaszewski IQ PL 07 Feb '19

07 Feb '19

Hi I have a testing lab with: debian10 + dovecot-2.2.33 (director) and one backaned with 2.2.33.2 mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h All works fine but I thinking now about solutions to moved all messeges older by (14day) to my alter storage with poor disk to folder Archive like:/vmail/domain/user@domain/Maildir/ to: /otherstorage/vmail/domain/user@domain/ And i thinking about ( hmm mapping folder Archive) /vmail/domain/user@domain/Maildir/Archive/ mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h:ALT:/otherstorage%h is that "solutions" Is good idea ? Or maby is another working solutions ? because: doveadm altmove not working with Maildir

1 0

"sieve: failed to store into mailbox 'Junk': Read-only mbox" over root_squashed NFS, lmtp : euid/egid set and access() don't mix together for me
by Ludovic POUZENC 07 Feb '19

07 Feb '19

Hi, I try to migrate an old fashioned mailsystem to Debian 9.7 / dovecot 2.2.7. I "have" to cope with mbox for now. I try to get rid of Sun OS 5.9 sendmail before mbox to mdbox migration (I'm fine if you laugh loudly ^^). Intended setup : 2 VM with exim (smtp in, smtp out roughly), 3 VM with dovecot (mbox, maildir, testbed), 1 VM with IMAP proxy and LMTP proxy. doveconf -n is at end of this mail. My test case is : root@wagram:~# swaks --to tstifi04 --server imap --protocol lmtp --header-X-Spam-Status yes root@wagram:~# (imap VM LMTP proxies to telegraphe5 VM in this test) mbox folders are in users homedir, no generic "vmail" unix account. Real posixAccounts in LDAP, NFS root_squashed. sieve "fileinto "Junk" call goes wrong : > Feb 6 17:56:03 telegraphe5 dovecot: lmtp(tstifi04): Error: > PytSHqIRW1x2dgAA+Fldtw: sieve: msgid=unspecified: failed to store into > mailbox 'Junk': Read-only mbox straced : https://pastebin.com/A53hDYnS I may miss some configuration options... but I get stuck. I get to IRC and it seems that there is no simple things to circumvent. I tried to read some code path too. https://wiki.dovecot.org/LMTP states : > > Security > > Unfortunately LMTP process currently needs to run as root, and only > temporarily drop privileges to users. Otherwise it couldn't handle > mail deliveries to more than a single user with different UID. If > you're using only a single global UID/GID, you can improve security by > running lmtp processes as that user: > service lmtp { > user = vmail > } lmtp run as root, drop temporarily privileges. The point, IHMO, is lmtp calls sieve code paths, that call some mbox saving function, that calls libc/syscall access(). And this explicitly not consider effective uid/gid. From strace (more in pastebin) : > [pid 30326] geteuid() = 0 > [pid 30326] setresuid(-1, 20609, -1) = 0 > [pid 30326] geteuid() = 20609 > [pid 30326] access("/home/tstifi04/mail-imap/Junk", R_OK|W_OK) = -1 > EACCES (Permission denied) From man access > The check is done using the calling process's real UID and GID, > rather than the effective IDs as is done when actually > attempting an operation (e.g., open(2)) on the file. > Similarly, for the root user, the check uses the set of permitted > capabilities rather than the set of effective capabilities; and > for non-root users, the check uses an empty set of capa- > bilities. I think that the process has effectively sufficient permissions to write into the root_squashed file, and infortunately access() check another thing. In dovecot sources, src/lib/eacces-error.c is aware of those "problems" with access(), but I think that mbox and maybe other storage backends don't use this for main codepath (like save a mail), but "only" for smart log messages in some cases. I may gone wrong while seeking about it. Do you see a configuration that can use root squashed mboxes and LMTP ? Should test_access() variant could be used as access() replacement ? There is eaccess() and euidaccess() too but may be not portable enough (_GNU_SOURCE only). Regards, Ludovic telegraphe5:/dev/shm# mount | grep tstifi04 cifs1:/homeeleves/tstifi/tstifi04 on /home/tstifi04 type nfs (rw,nosuid,nodev,relatime,vers=3,rsize=65536,wsize=65536,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=172.16.2.29,mountvers=3,mountport=635,mountproto=udp,local_lock=none,addr=172.16.2.29) telegraphe5:/dev/shm# dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.7 auth_debug = yes auth_verbose = yes default_client_limit = 10240 default_process_limit = 2048 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_debug = yes mail_fsync = always mail_location = mbox:~/mail-imap:INBOX=/var/mail/mailbox/%u:INDEX=/var/dovecot-indexes/%u mail_nfs_storage = yes mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = count:Quota mail global quota_rule = *:storage=100M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:/var/mail/mailconf/%1u/%u/sieve;active=/var/mail/mailconf/%1u/%u/.dovecot.sieve sieve_after = /var/mail/mailconf/global/sieve/after.d/ sieve_before = /var/mail/mailconf/global/sieve/before.d/ sieve_global = /var/mail/mailconf/global/sieve sieve_vacation_dont_check_recipient = yes } protocols = " imap lmtp sieve sieve" service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service imap-login { inet_listener imap { port = 0 } } service lmtp { inet_listener lmtp { port = 24 } } service managesieve { process_limit = 16 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 } user = root } ssl = required ssl_cert = </etc/ssl/local_certs/telegraphe5_cert.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota imap_quota } telegraphe5:/dev/shm# grep -vE '^(#|$)' /etc/dovecot/dovecot-ldap.conf.ext uris = ldaps://ldap-test.mines-albi.fr tls_require_cert = hard auth_bind = yes base = ou=People,dc=enstimac,dc=fr user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,\ dcMailQuota=quota_rule=*:bytes=%{ldap:dcMailQuota}M user_filter = (&(objectClass=posixAccount)(|(uid=%n)(mail=%n(a)mines-albi.fr))) iterate_attrs = uid=user iterate_filter = (objectClass=posixAccount) telegraphe5:/dev/shm# ls -l /var/mail/mailconf/global/sieve/before.d/ total 0 telegraphe5:/dev/shm# ls -al /var/mail/mailconf/t/tstifi04/ total 44 drwx------ 3 tstifi04 ifie2012 4096 févr. 5 10:46 . drwxrwxrwt 169 root root 16384 janv. 5 18:48 .. lrwxrwxrwx 1 tstifi04 ifie2012 25 janv. 31 17:50 .dovecot.sieve -> sieve/rainloop.user.sieve -rw------- 1 tstifi04 ifie2012 1520 févr. 5 13:22 .dovecot.sieve.log -rw------- 1 tstifi04 ifie2012 10336 févr. 5 10:46 .dovecot.sieve.log.0 -rw------- 1 tstifi04 ifie2012 172 janv. 31 17:56 .dovecot.svbin drwx------ 3 tstifi04 ifie2012 4096 janv. 31 17:50 sieve telegraphe5:/dev/shm# ls -al /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve -rw------- 1 tstifi04 ifie2012 102 janv. 31 17:50 /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve telegraphe5:/dev/shm# cat /var/mail/mailconf/t/tstifi04/sieve/rainloop.user.sieve # This is RainLoop Webmail sieve script. # Please don't change anything here. # RAINLOOP:SIEVE telegraphe5:/dev/shm# telegraphe5:/dev/shm# cat /var/mail/mailconf/global/sieve/after.d/spam-into-junk.sieve require ["fileinto"]; if header :is "X-Spam-Status" "Yes" { fileinto "Junk"; stop; }

1 0

acl_groups in LDAP
by Christian Rößner 06 Feb '19

06 Feb '19

Hi, I found a 9 year old thread (https://www.dovecot.org/list/dovecot/2010-October/054407.html) concerning acl_groups in OpenLDAP. In this thread someone asked, if it is possible to provide ACLs as multi value in OpenLDAP. I know that Dovecot expects acl_groups as a comma separated list, so currently I do this with a single value. Did the code change a little bit and accepts multi values now? Would be nice to have attributes like: ACLAttribute: group1 ACLAttribute: group2 ... Instead of: ACLAttribute: group1,group2 Thanks in advance Christian -- Rößner-Network-Solutions Karl-Bröger-Str. 10, 36304 Alsfeld T: +49 6631 9110725, F: +49 6631 78823409, M: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner-network-solutions.com

2 1

Release notify (2.2.36.1 and 2.3.4.1)
by Aki Tuomi 05 Feb '19

05 Feb '19

Due to DMARC issues some people have failed to receive the latest security information, so here it is repeated for both releases: 2.3.4.1 https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/ * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. 2.2.36.1 https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.1.tar.gz.sig * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. - pop3_no_flag_updates=no: Don't expunge RETRed messages without QUIT - director: Kicking a user assert-crashes if login process is very slow - lda/lmtp: Fix assert-crash with some Sieve scripts when mail_attachment_detection_options=add-flags-on-save - fs-compress: Using maybe-gz assert-crashed when reading 0 sized file - Snippet generation crashed with invalid Content-Type:multipart

4 13

SELinux policy to allow Dovecot to connect to Mysql
by Robert Moskowitz 05 Feb '19

05 Feb '19

As I have noted in previous messages, I been getting the following on my new mailserver: Apr 7 10:17:27 z9m9z dovecot: dict: Error: mysql(localhost): Connect failed to database (postfix): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry They go away when I setenforce 0. It is not a timing issue as I earlier thought. So I googled dovecot mysql selinux and the only worthwhile hit was: http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6.h… that provides a /etc/selinux/dovecot2mysql.te and other selinux stuff. Is there a simpler way like a setsbool option? With all the howtos on dovecot with mysql, it is interesting that none of them seem to have this problem. Maybe because they connect to mysql through TCP port 3306 which has ITS set of problems (like MariaDB defaults to not listening on TCP). thanks!

1 3

problem using different dovecot versions
by Gonzalo Palacios Goicolea 05 Feb '19

05 Feb '19

Hi All, I'm new to the list and may be it's a known issue. I have a set of servers with RHEL6 and dovecot-2.2.10-1_14.el6.x86_64 and another set of servers with RHEL7 and, now, with dovecot-2.2.36-3.el7.x86_64. Both sets write to the same NFS. Since I updated RHEL7 servers (from 2.2.10-8.el7.x86_64) I've problems with index files when a RHEL7 dovecot service write to the filesystem of a user (the first log line corresponds to RHEL7 and the others to RHEL6): Feb 5 09:33:05 listas3 dovecot: lda(user@domain): sieve: msgid=<007bxxxxxxx(a)uam.es>: stored mail into mailbox 'INBOX' Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Error: Corrupted transaction log file /.../Maildir/dovecot.index.log seq 1610: Invalid transaction log size (28408 vs 28528): /.../Maildir/dovecot.index.log (sync_offset=28408) Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Panic: file mail-index-sync-keywords.c: line 227 (keywords_update_records): assertion failed: (data_offset >= sizeof(struct mail_index_record)) Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0() [0x3713268b8a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3713268bf6] -> /usr/lib64/dovecot/libdovecot.so.0() [0x37132224aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_keywords+0x7fd) [0x3713aca43d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_record+0xec) [0x3713acacac] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x234) [0x3713acbae4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x83) [0x3713abcce3] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_refresh+0xe) [0x3713ab793e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_sync_header_refresh+0x10) [0x3713a4e1e0] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4e330] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4f3d4] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3713a4f7b3] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xd9) [0x3713a4fa59] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x31) [0x3713a7d731] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x27) [0x3713a7e7b7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x62) [0x3713aa8fc2] -> /usr/lib64/dovecot/lib10_quota_plugin.so(+0xc3ec) [0x7fd272dfe3ec] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5c) [0x3713a7f4fc] -> dovecot/imap(imap_status_get+0x7a) [0x41dbea] -> dovecot/imap(cmd_status+0x179) [0x413059] -> dovecot/imap(command_exec+0x3d) [0x4170bd] -> dovecot/imap() [0x416180] -> dovecot/imap() [0x41627a] -> dovecot/imap(client_handle_input+0x11d) [0x4164ed] -> dovecot/imap(client_input+0x6f) [0x41685f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x3713278a56] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xa7) [0x3713279b27] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x37132789c8] Feb 5 09:33:25 buzon1 dovecot: imap(user@domain): Fatal: master: service(imap): child 2057 killed with signal 6 (core dumped) Feb 5 09:33:25 buzon4 dovecot: imap-login: Login: user=<user@domain>, method=PLAIN, rip=192.168.x.x, lip=150.x.x.x, mpid=3459, session=<ZUSAdiGBdwDAqAzY> Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Panic: file mail-index-sync-keywords.c: line 227 (keywords_update_records): assertion failed: (data_offset >= sizeof(struct mail_index_record)) Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0() [0x3a88668b8a] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3a88668bf6] -> /usr/lib64/dovecot/libdovecot.so.0() [0x3a886224aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_keywords+0x7fd) [0x3a88eca43d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_record+0xec) [0x3a88ecacac] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x234) [0x3a88ecbae4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x83) [0x3a88ebcce3] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88eb797c] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88eb7d58] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_open+0xf0) [0x3a88eb7ec0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_mailbox_open+0xad) [0x3a88eab2bd] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e4d71a] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e4d7ef] -> /usr/lib64/dovecot/libdovecot-storage.so.0() [0x3a88e7f694] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_open+0xf) [0x3a88e7f84f] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x4a) [0x3a88ea8faa] -> /usr/lib64/dovecot/lib10_quota_plugin.so(+0xc3ec) [0x7fbd599263ec] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5c) [0x3a88e7f4fc] -> dovecot/imap(imap_status_get+0x7a) [0x41dbea] -> dovecot/imap(cmd_status+0x179) [0x413059] -> dovecot/imap(command_exec+0x3d) [0x4170bd] -> dovecot/imap() [0x416180] -> dovecot/imap() [0x41627a] -> dovecot/imap(client_handle_input+0x11d) [0x4164ed] -> dovecot/imap(client_input+0x6f) [0x41685f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x3a88678a56] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xa7) [0x3a88679b27] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x3a886789c8] Feb 5 09:33:30 buzon4 dovecot: imap(user@domain): Fatal: master: service(imap): child 3459 killed with signal 6 (core dumped) Due to this issue when the user goes into his webmail, he can not see the inbox. If I delete dovecot.* files from the user maildir it gets solved, but usually it happens again, so it's not the solution. Is it any solution for this issue or should I downgrade dovecot to 2.2.10-8.el7.x86_64 again? Thanks and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco <3D"http://www.uam.es/">

1 0

CVE-2019-3814: Suitable client certificate can be used to login as other user
by Aki Tuomi 05 Feb '19

05 Feb '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. Please find patches for v2.2.36 and v2.3.4 attached, or download new version from https://dovecot.org Yours sincerely, Aki Tuomi Open-Xchange Oy Product: Dovecot Vendor: Open-Xchange Oy Internal reference: DOV-2890 (Bug ID) Vulnerability type: Improper Authentication - Generic (CWE287) Vulnerable versions: 1.1.0 - 2.2.36 and 2.3.0 - 2.3.4 Vulnerable component: authentication Report confidence: Confirmed Solution status: Fixed by Vendor Fixed versions: 2.2.36.1, 2.3.4.1 Vendor notification: 2019-01-16 Solution date: 2019-01-20 Public disclosure: 2019-02-05 Researcher Credits: https://hackerone.com/halfdog CVE reference: CVE-2019-3814 CVSS: 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vulnerability Details: Normally Dovecot is configured to authenticate imap/pop3/managesieve/submission clients using regular username/password combination. Some installations have also required clients to present a trusted SSL certificate on top of that. It's also possible to configure Dovecot to take the username from the certificate instead of from the user provided authentication. It's also possible to avoid having a password at all, only trusting the SSL certificate. If the provided trusted SSL certificate is missing the username field, Dovecot should be failing the authentication. However, the earlier versions will take the username from the user provided authentication fields (e.g. LOGIN command). If there is no additional password verification, this allows the attacker to login as anyone else in the system. This affects only installations using: auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes Attacker must also have access to a valid trusted certificate without the ssl_cert_username_field in it. The default is commonName, which almost certainly exists in all certificates. This could happen for example if ssl_cert_username_field is a field that normally doesn't exist, and attacker has access to a web server's certificate (and key), which is signed with the same CA. Attack can be migitated by having the certificates with proper Extended Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'. Also, ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This does not apply to Dovecot Submission service. Proof of concept Create a CA certificate for signing, and sign a certificate with missing commoName attribute. With following configuration passdb { driver = static arguments = nopassword } ssl_ca =</path/to/ca.pem auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes You are able to log in as any user with this certificate using following commands: openssl s_client -connect server:port -cert /path/to/cert -key /path/to/key a LOGIN anyusername anypassword

1 0

Dovecot 2.3.4.1 released
by Aki Tuomi 05 Feb '19

05 Feb '19

https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.4.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.2.tar.gz.sig> Binary packages in https://repo.dovecot.org/ * CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field (ssl_cert_username_field), under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. * ssl_cert_username_field setting was ignored with external SMTP AUTH, because none of the MTAs (Postfix, Exim) currently send the cert_username field. This may have allowed users with trusted certificate to specify any username in the authentication. This bug didn't affect Dovecot's Submission service. --- Aki Tuomi Open-Xchange oy

1 0