- dovecot - dovecot.org

Downgrade dovecot if required
by Durga Prasad Malyala 17 Dec '18

17 Dec '18

Hello all, I have version 2.3.3-2 of dovecot and could see version 2.3.4-2 available from the repos. How is feedback after upgrade to 2.3.4-2? Any issues? Can I revert back to older version if I face any problems? Cheers/DP

2 1

ssh_dh?
by Daniel Miller 17 Dec '18

17 Dec '18

Don't know if this was corrected in 2.3.4 (haven't upgraded yet but didn't see it in the notes) - but in 2.3.3 I see this in my log: imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssh_dh=</path/to/dh.pem So...either there's an undocumented feature of SSH-over-IMAP (that's Dovecot - always on the cutting edge!) or someone had a coffee shortage during a coding session... -- Daniel

5 5

Sieve scripts not backed up
by Marc Weustink 17 Dec '18

17 Dec '18

Hi all. I try to backup out sieve scripts through doveadm -o stats_writer_socket_path= backup -R -u marc -N tcp:<remote.host>:4191 All mail is backed up but no scripts. What am I doing wrong ? Thanks Marc doveconf -n # 2.3.4 (0ecbaf23d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 (60b0f48d) # OS: Linux 4.4.0-137-generic x86_64 Ubuntu 16.04.5 LTS autofs # Hostname: xxx dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql-local.conf.ext } doveadm_password = # hidden, use -P to show it mail_debug = yes mail_gid = vmail mail_home = /home/mail/backup/%n mail_location = maildir:/home/mail/backup/%n/mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace Shared { location = maildir:/home/mail/backup/Common/mail:INDEXPVT=/home/mail/backup/%n/mail/common prefix = Shared/ separator = / subscriptions = no type = public } namespace Users { list = children location = maildir:/home/mail/backup/%%n/mail:INDEXPVT=/home/mail/backup/%n/mail/shared/%%n prefix = Users/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = sieve service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = vmail user = vmail } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

2 1

Upgrade to 2.3.1 has failed
by C. Andrews Lavarre 17 Dec '18

17 Dec '18

Problem: We had Dovecot v2.2 working just fine under openSUSE Leap 42.3. But we upgraded openSUSE to Leap 15.0. In the process, Dovecot got upgraded from 2.2 to 2.3.1. It no longer works and I haven't figured out how to downgrade to the older working version. The key issue seems to be the change to requiring dh.pem and changing s sl_protocols to ssl_min_protocols. I think I've navigated both correctly, but it still doesn't work. The error is auth: Error: stats: open(old-stats-user) failed: Permission denied as a consequence of which we get imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: There is no valid PEM certificate. We have followed the instructions at https://wiki.dovecot.org/S SL/DovecotConfiguration 1. We have created /etc/dovecot/dh.pem (yes it took five hours) 2. We have edited 10-ssl.conf as directed by the Wiki: ssl = yes ssl_cert = /etc/certbot/live/privustech.com/fullchain.pem ssl_key = /etc/certbot/live/privustech.com/privkey.pem ssl_dh = /etc/dovecot/dh.pem #(yes, it took five hours to create...) ssl_min_protocol = TLSv1 ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_prefer_server_ciphers = no 3. We have checked 10-ssl.conf against the 2.3 default at https://github.com/dovecot/core/blob/master/doc/example-config/conf.d/10-ss… 4. We do NOT include the less than (<) symbol before the paths because then dovecot fails to load complaining it cannot find the files. 5. we have checked all the pem keys, certificates, and dh files with cat, they all exist and are in the expected hash format. 6. We have followed the instructions to set their permissions root:root 0444 and 0400 accordingly. 7. We have rebooted the host. Any help or clues would be most appreciated. Kind regards, Andy

7 20

ECDSA client question
by Michael A. Peters 16 Dec '18

16 Dec '18

Hi, for those who have adopted ECDSA, Are there still any commonly used IMAPS/POP3S clients that still can not handle ECDSA certificates? I know you can set up Dovecot dor dual cert, I am just trying to determine if there still is a real world need to.

2 1

Plugins mailboxalias subfolders
by Marc Roos 16 Dec '18

16 Dec '18

This plugin does not work anymore when subfolders are created. https://wiki2.dovecot.org/Plugins/MailboxAlias

1 0

mailbox locking
by Victor Sudakov 16 Dec '18

16 Dec '18

Dear Colleagues, I use exim's appendfile transport, procmail and a local mutt on my system, they all (to my knowledge) use lockfiles when working with mboxes. However, `doveconf | grep lock` says dotlock_use_excl = yes lock_method = fcntl mail_max_lock_timeout = 0 mbox_dotlock_change_timeout = 2 mins mbox_lock_timeout = 5 mins mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl pop3_lock_session = no Do I need to change anything in dovecot's default locking setup? Does it still use lockfiles on mboxes or not? There are some contradictory parameters IMHO. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

1 1

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 11:06 Tributh <dovecot-user(a)tributh.net> wrote: > > > > > Am 16.12.18 um 09:42 schrieb Aki Tuomi: > > > >> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi, > >> is that here the right place to make feature requests? > >> > >> dovecot supports as authentication mechanism > >> SCRAM-SHA-1 from RFC 5802 > >> which was updated to > >> SCRAM-SHA-256 in RFC 7677 > >> > >> Can SCRAM-SHA-256 be added to the authentication mechanisms? > >> > >> I would not like to request, that SCRAM-SHA-1 will be exchanged by > >> SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > >> > >> Regards > >> > >> Torsten > > > > Hi! > > > > Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? > > > > Aki > > > Hi Aki, > let me first answer the second question. > Sadly I have no client which supports it, yet. > Here we have a chicken or the egg causality dilemma. > There was some communication with mail-client developers which stated > that they would start developing it, when they have a publicly usable > server to test against. > Now I hope that the most common IMAP server could be the one, which > gives this possibility. > Sadly, most communication is not publicly available. > > In the past CRAM-MD5 was very popular. When the insecurity came out, > everything just shifted to TLS, but that prevented not from sending a > plain password now. If a malicious actor is able to change DNS/TLS > endpoints, he will receive the plain passwords immediately. > I am not the expert in explaining how such an actor could do this. I > just wanted to have possibilities for everybody to prevent this possible > exposure of a plain password, which could than easily used abusively. > > I just hope for better security in the future. > > Regards Torsten > > We'll see if this could be added. Aki

1 0

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi, > is that here the right place to make feature requests? > > dovecot supports as authentication mechanism > SCRAM-SHA-1 from RFC 5802 > which was updated to > SCRAM-SHA-256 in RFC 7677 > > Can SCRAM-SHA-256 be added to the authentication mechanisms? > > I would not like to request, that SCRAM-SHA-1 will be exchanged by > SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > > Regards > > Torsten Hi! Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? Aki

2 1

Feature request SCRAM-SHA-256
by Tributh 16 Dec '18

16 Dec '18

Hi, is that here the right place to make feature requests? dovecot supports as authentication mechanism SCRAM-SHA-1 from RFC 5802 which was updated to SCRAM-SHA-256 in RFC 7677 Can SCRAM-SHA-256 be added to the authentication mechanisms? I would not like to request, that SCRAM-SHA-1 will be exchanged by SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 Regards Torsten

1 0