- dovecot - dovecot.org

having problems with Argon
by Adam Gold 28 Sep '18

28 Sep '18

Hello everyone. I'm close to completing my first build of a mail server - Postfix, Dovecot, Postgres (I know, sounds like overkill), Rspamd with Redis and Unbound (please infer a mega lack of experience disclaimer). The model is standalone internet with remoted sasl-authenticated clients. Throughout the process I've been having consistent problems with user password authentication. Both when I began when I was only using flat files and now with pgsql, more often than not my username (full email address) and password combo have been rejected. The postfix logs started with fairly innocent 'failed login' messages and eventually reached the "you don't own this email address, you're a spammer" level. Dovecot has been consistent with "auth: Debug: client passdb out: FAIL" messages. Before I looked at this issue specifically, my guess was it came from a Postfix restriction but having spent quite a while going through it today, I don't think that's where it lies. Finally I went back to basics and changed an account password to {PLAIN}12345 and what do you know - effortless success! Previously I'd been using mainly argon, ssha512 sha512-crypt and a few others. My passwords are strong (well in excess of 20 characters, 'randomly' generated). I spent this afternoon narrowing down the hashes and while I haven't finished, the only one I couldn't get to work with 12345 was argon. I also noticed that the wiki says the 2I and 2ID versions of Argon are available, doveadm pw always returned a "does not exist" error when I tried to use 2ID. I'm using Dovecot version 2.3.2.1 (0719df592)

2 1

Collecting S/MIME Certs from (incoming signed) E-Mails
by Jochen Bern 27 Sep '18

27 Sep '18

Two quick questions, if I may: We've been asked to change an existing application (whose builtin S/MIME capabilities are quite unclear) so that the e-mails it sends will be S/MIME encrypted, if possible. I have some experience in getting an MTA to encrypt e-mails in transit, but the trick is, of course, to maintain a list of addressees' (current) certs. Ideally, users send e-mails *to* the application beforehand, and with a bit of luck, they might even *sign* them (which, in the case of S/MIME, IIUC implies that their cert is attached). 1. Are there features in a) the IMAP protocol and/or b) dovecot in particular that would allow me to extract the certs from incoming e-mails before the application retrieves them from the mailbox? (I know that IMAP allows me to download only a MIME part of an e-mail, but I'ld need to somehow determine *which* MIME part to download, I guess?) 2. Assuming that the incoming e-mail is S/MIME signed *and encrypted*, is it actually possible to extract the sender cert *without* having the application's keypair to *decrypt* the e-mail in the process? Kind regards, -- Jochen Bern Systemingenieur www.binect.de www.facebook.de/binect

1 0

Custom variable
by Ángel L. Mateo 27 Sep '18

27 Sep '18

Hi, I know that there are some variables (as user or username) I could use inside dovecot. They are at https://wiki2.dovecot.org/Variables. My question is if I can create my own variables from attributes at my pass/user db and then use it inside dovecot configuration. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 5

Connection and login scripts callback
by Stanislav Humplík 27 Sep '18

27 Sep '18

Hello, currently there is very handy post-login scripting already implemented but it naturally executes only when successful login happens. I would like to have another two script callbacks which runs: 1. immediately after client connects to server - dovecot should run script with connection IP and wait for result and then reject/accept connection with return message accordingly. 2. after failed login - dovecot should exec script with connection IP, login params without waiting for result The main reason behind this idea is to use some logic, database (redis...) or indicators like GeoIP, p0f as bruteforce prevention. It might be also usable for IP based ACLs. AFAIK the only way to create something similar is to proxy whole authentication to some external process, which is not desirable when dovecot manages user database. SH

2 1

Can't authenticate using ARGON2ID crypt scheme from doveadm pw w/rounds != default
by Keith Amidon 27 Sep '18

27 Sep '18

I'm using dovecot version 2.3.2.1 (0719df592) and trying to use the ARGON2ID crypt scheme for authentication using the passdb passwd-file driver. My passdb config is very simple: passdb { driver = passwd-file args = username_format=%u <path-to-file-here> } If I generate a password this way: doveadm pw -s ARGON2ID -p 'This is a test' I get a crypt value for the password that I can place in the password file like: testuser:{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$UuqF25QtumNBe9R2FmUZvA$5avvHY5TIaj5Wl5C4k8BOI4bcmNei7BwPLlXYQVybMc And if I test authentication with this command: doveadm auth login testuser 'This is a test' It works as shown by the (lightly redacted) log: Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: auth client connected (pid=55417) Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: client in: AUTH 1 PLAIN service=doveadm debug resp=<hidden> Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: passwd-file(testuser): lookup: user=testuser file=<path-to-passwd-file> Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: client passdb out: OK 1 user=testuser However, if I instead specify a non-default number of rounds this way: doveadm pw -s ARGON2ID -p 'This is a test' -r 7 and place the result in an entry in the password file like: testuser:{ARGON2ID}$argon2id$v=19$m=1048576,t=7,p=1$kIhnUR13GrtOvvpbJNJmnQ$o7O6Whxs3s8IE09yY9S2dPkJjJyEVc78GRFilYVS9fU Then testing authentication using the same command (repeated here): doveadm auth login testuser 'This is a test' then authentication fails, as shown by this (lightly redacted) log: Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: auth client connected (pid=55557) Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: client in: AUTH 1 PLAIN service=doveadm debug resp=<hidden> Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: passwd-file <path-to-passwd-file>: Read 3 users in 0 secs Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: passwd-file(testuser): lookup: user=testuser file=<path-to-passwd-file> Sep 25 22:52:05 myhost dovecot[17538]: auth: passwd-file(testuser): Password mismatch Sep 25 22:52:07 myhost dovecot[17538]: auth: Debug: client passdb out: FAIL 1 user=testuser Experimentation with other values for the -r option has not produced a value that works for me. Using the exact same procedure but the BLF-CRYPT scheme, with varying number of rounds, does work. Am I doing something wrong or is there a bug in either the doveadm pw generation or the auth evaluation of the password? I'd like to use ARGON2ID with ~6 rounds if I can make this work. Any help would be greatly appreciated. Thanks, Keith

2 2

What causes folders to be reported as noselect?
by Daniel Miller 26 Sep '18

26 Sep '18

As the subject says. This may be a bit open-ended - but it would really help troubleshooting some obscure folder issues. In my case, I happen to have both some "real" folders and also some "virtual" folders that respond to IMAP LIST commands with the "\NoSelect" flag - and I don't know why. Via telnet, I can manually issue SELECT, SEARCH, and FETCH for such folders without errors. -- Daniel

2 2

Possible bug - otherwise a public admission of oops
by Daniel Miller 26 Sep '18

26 Sep '18

While trying to identify possible causes of wrong mail folder creation I did something...bad. Normally, I would recognize that deleting a mail folder would naturally delete all the contained mails. However...somehow my imaginative self decided that deleting a virtual folder via IMAP would only delete the virtual folder...and not proceed to delete every referenced email via the virtual mapping. So note to self, and possible reminder to others, deleting a virtual folder via a filesystem command is just tiny bit different than via IMAP... Fortunately I keep my feathers numbered for just such an emergency... -- Daniel

1 0

dovecot/FreeBSD and Android IMAP clients
by Victor Sudakov 25 Sep '18

25 Sep '18

Dear Colleagues, I have a fairly vanilla setup of dovecot on FreeBSD, serving IMAP and POP3. Thunderbird/IMAP works fine, and so does mutt/IMAP. However, Android clients (Gmail/IMAP and K-9 Mail) have problems accessing folders other than the INBOX. They either show them empty with no mails (K-9) or just wait forever to view the contents (Gmail app). Do I need to set up some workarounds or hacks in dovecot for Android IMAP clients to work correctly? Any advice is appreciated. My config is below: # 2.3.2.1 (0719df592): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.2-RELEASE-p3 amd64 # Hostname: admin.sibptus.ru mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </usr/local/etc/exim/mail.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

2 2

Nightly builds of Debian packages
by Christoph Pleger 24 Sep '18

24 Sep '18

Hello, how is the future of the automatically built nightly debian packages of dovecot? Has that project been ceased? The current auto-built version is still 2.2.28 from April 28, though 2.2.29 (with a security patch) of dovecot is out now for a while. Regards Christoph

4 3

Last_login plugin and mysql
by Thomas Hooge 24 Sep '18

24 Sep '18

Hello, i have problems configuring the last_login plugin with mysql. I have extended the postfixadmin database with a new field, configured the plugin as described in the wiki. Finally i got errors: table is not writable, INSERT failed. Why is the insert required? The plugin should only UPDATE the column for existing rows. Or am i missing some configuration options? Here is my dictionary config: map { pattern = shared/last-login/$user table = mailbox value_field = x_last_login value_type = uint fields { username = $user } } Dovecot: 2.2.27 (c0f36b0) Kind regards, Thomas

2 2