- dovecot - dovecot.org

Released Pigeonhole v0.4.24 for Dovecot v2.2.36.
by Stephan Bosch 24 May '18

24 May '18

Hello Dovecot users, Here is the Pigeonhole release that goes with the new Dovecot v2.2.36 release. Apart from the changes that were already in the RC, this final release adds one new feature: a plugin for the IMAP FILTER=SIEVE capability. The is a vendor-defined feature that adds the ability to manually invoke Sieve filtering in IMAP. Changelog v0.4.24: + Implement plugin for the a vendor-defined IMAP capability called "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - Fix assert panics triggered by empty messages that are being forwarded using redirect or vnd.dovecot.report. This does not likely normally occur, but this is seen as a result of certain benign failures in object storage. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Autofile Junk for all users
by ＠lbutlr 23 May '18

23 May '18

How would I get the rule if header :contains "X-spam-flag" "YES" { fileinto "Junk"; } To apply to all users mail at delivery time?

4 4

Creating users on the fly, for testing?
by Eric Abrahamsen 23 May '18

23 May '18

I'm trying to set up a reproducible test environment for a MUA I'm working on, with accounts and dummy data that can be trashed and restored while testing. I'd like to exercise the IMAP client part of the MUA, and am looking into using a local dovecot instance to do that. I'm trying to make this as minimal-config as possible: ideally the test environment could create a dummy (virtual) user, insert dummy message data, allow the MUA to log in and manipulate the messages, and then destroy both user and message data at the end of the session. I have the sense that I'll be able to get there by shipping a custom config file along with the test library, that sets up a virtual user with a mail_location under /tmp, and then all operations are done with dovecot -c customconfig.conf Then the temp folder is trashed at the end of the session. Is this likely to work? Is anything likely to bite me? Thanks, Eric

1 0

v2.2.36 released
by Timo Sirainen 23 May '18

23 May '18

https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz.sig This is the last planned v2.2.x release. We didn't fix everything reported (especially build changes) to try to minimize any unexpected breakages. v2.3.2 will be out with a lot of fixes hopefully in a few weeks. That will start becoming the recommended version to run then. * login-proxy: If ssl_require_crl=no, allow revoked certificates. Also don't do CRL checks for incoming client certificates. * stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. + doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. + doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. + cassandra: Use fallback_consistency on more types of errors - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - In some configs if namespace root directory didn't yet exist, Dovecot failed to create mailboxes.lock when trying to create mailboxes - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it. - dict-sql: Fix crash when reading NULL value from database

1 0

XMPP notifications
by André Rodier 23 May '18

23 May '18

Hello all, What is the best way, using sieve, to send XMPP notifications? I am using Debian Stretch, with Dovecot core / sieve packages version 2.2.27-3+deb9u2. Should I use the enotify extension, or a script with extprograms extension? Thanks for your answers. -- André Rodier

2 2

Re: Lmtp issues on dovecot 2.3.x with big messages
by Michael Tratz 23 May '18

23 May '18

> >> Messages are being sent to dovecot LMTP by postfix. If I change this email > >> to another server with dovecot 2.2.x the same message are delivered > >> immediately. > > Confirmed. Starts to fail here around 30Mb. Tested with Swaks. > > > > Working on a fix... > > Problem found. It is an explicit limit of 40Mb (for the 30Mb I saw in my > tests, there was also a base64 encoding I forgot about). > > Will fix both the unhelpful error and the fact that there should be no > limit (currently) for LMTP. > Stephan, I’m having the same issue with LMTP and large messages with dovecot 2.3.x. Can you tell me which commit fixes this issue? I looked through the GitHub commits, but it’s not clear to me which commit fixes this issue. I’d like to apply the patch and re-compile dovecot for my machines instead of having to downgrade to 2.2.35. Thanks, Michael

3 3

lazy_expunge ...
by Matt Bryant 23 May '18

23 May '18

So I decided to configure this plugin and take it for a test drive .. configured using mdbox (main namespace is Maildir) .. So as per Wiki have the following namespaces defined ... location is held within db ... but basically Maildir:~/Maildir for inbox namespace ==== 8< =============== namespace inbox { list = yes type = private inbox = yes prefix = INBOX/ separator = / mailbox Drafts { auto = create special_use = \Drafts } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } mailbox Sent { auto = create special_use = \Sent } mailbox Archive { auto = create special_use = \Archive } } namespace lazyexpunge { prefix = .EXPUNGED/ hidden = yes list = children subscriptions = no separator = / location = mdbox:~/mdbox:INDEX=~/mdbox:MAILBOXDIR=expunged:LISTINDEX=expunged.list.index } ==================== Can see its working since can see files in the mdbox storage along with indexs etc ... but there seems little to no documentation on how to delete from the expunged namespace and atm trying to even search doesnt seem to work .. doveadm -Dvvv search -u matt(a)the-bryants.net mailbox .EXPUNGED/* subject space gets errors below .. and although says refer to server log .. nothing in there either .. mail_debug is on ... doveadm(matt(a)the-bryants.net): Debug: fts: Indexes disabled for namespace '' doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash/cobbler: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash/cobbler failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] Any ideas is there any better doco around this plugin and use etc ... thanks & rgds Matt

2 6

Upgrading dovecot 2.2 to 2.3 without downtime when using proxy/director?
by Niels Kobschätzki 23 May '18

23 May '18

Hi, I have a setup with several dovecot-servers (2.2.35) and I use dovecot proxy. I upgraded one server to 2.3.1 and got the configs fixed so far that it started again. But when I tried to add it into the proxying again with "doveadm director add" I see the following in the logfiles: May 6 07:19:30 host dovecot: director: Warning: Director xxx.xxx.xxx.176:9090/out disconnected us with reason: Invalid input: OPTIONS May 6 07:19:30 $host dovecot: director: Connecting to xxx.xxx.xxx.171:9090 (as xxx.xxx.xxx.176): Reconnecting after error xxx.xxx.xxx.176 is the upgraded host, xxx.xxx.xxx.171 is one of the other hosts (the applicable hosts are in the range xxx.xxx.xxx.171-176). Do I have to remove all the hosts from the proxy, upgrade them and then add them again? Or is there a way to handle the upgrade without a downtime? After all one of the reasons I use several hosts is that I do not want to have a downtime. Niels

3 3

Re: Best mail encryption solution for per-user
by Aki Tuomi 23 May '18

23 May '18

On 23.05.2018 10:15, mail(a)sjemm.net wrote: > May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >> On 23.05.2018 09:13, mail(a)sjemm.net wrote: >> >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >>>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>> >>> Hi Tai74 and Aki, >>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>> I have setup my dovecot with the following in a conf file: >>> >>> ============== >>> >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> mail_plugins = $mail_plugins mail_crypt >>> plugin { >>> >>> mail_crypt_curve = secp521r1 >>> >>> mail_crypt_save_version = 2 >>> >>> } >>> >>> ============== >>> >>> This works nice, all emails are being encrypted and every user/folder has keys. >>> But as I understood from your conversation these keys are not protected. And I want them to be >>> protected by the users password used by imap. >>> >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>> the DB and postfix/dovecot) >>> >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>> >>> should i use mail_crypt_private_password = ? >>> how do i point it to the mysql db then? >>> im unsure about this >>> >>> Do you have any hints on this? >>> >>> Kind regards, >>> Zjemm >>> >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>> user's keys using user's login password, you must have a TOOL that manages this. >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>> user changes his password. >>> >>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>> recover the emails without backup copy of the private key. >>> >>> Aki >>> >>> Hi Aki >>> >>> I used the following command: >>> dovecot pw -s SHA256-CRYPT >>> >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>> >>> This output is used to store in the password fields in the database. So no plain text passwords no >>> :) >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. >>> >>> can you explain this a bit more for me? >>> >>> for now i have in the 10-auth.conf file the following: >>> ============== >>> passdb { >>> driver = sql >>> >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>> args = /etc/dovecot/dovecot-sql.conf.ext >>> } >>> >>> and: >>> >>> userdb { >>> driver = static >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>> } >>> ============== >>> >>> then i have in dovecot-sql.conf.ext >>> ============== >>> driver = mysql >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>> default_pass_scheme = SHA256-CRYPT >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>> ============== >>> Where do i need to set : mail_crypt_private_password = %w ? >>> >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>> so this step isnt nesesary anymore am i right? >>> >>> Thank you for your quick response, very helpfull >>> >>> Zjemm >>> >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>> password is.. >>> >>> So: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> Aki >>> >>> Hi Aki, >>> >>> Thank you very much for your help, i realy appreciate that. >>> >>> Ok so if i understand it correctly i'll have to use: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> in my dovecot-sql.conf.ext file >>> >>> This query selects the user, the password, and %w >>> >>> if i run a little query myself: >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>> FROM virtual_users; >>> +------------------+----------------------------------+------------------------------------+ >>> | user | password | userdb_mail_crypt_private_password | >>> +------------------+----------------------------------+------------------------------------+ >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>> +------------------+----------------------------------+------------------------------------+ >>> >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>> is typing in the password when authenticating. >>> >>> is this correct? >>> >>> yes. >>> >>> so then i have the username the hashed password en the plaintext password as a result of the query. >>> >>> yes >>> >>> now userdb_mail_crypt_private_password = the plaintext password >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>> >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>> {} section. >>> >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>> >>> Thanks again and have a great weekend. >>> >>> Zjemm >>> >>> Aki >>> >>> Hi Aki, >>> >>> Cool i'm testing it right now. >>> I have set up a new mailserver (life is great with lxc containers :) ) >>> >>> postfix and dovecot are working like normal >>> >>> next i enable mail_crypt >>> >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>> ========================== >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> >>> mail_plugins = $mail_plugins mail_crypt >>> >>> plugin { >>> mail_crypt_curve = secp521r1 >>> mail_crypt_save_version = 2 >>> } >>> ========================== >>> >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>> >>> so the query is now the new query: >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u'; >>> >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>> there. >>> >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>> the mutt client drops the connection. >>> >>> in the log i can see: >>> >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>> failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>> =571:2,) failed: Private key not available: Cannot decrypt key >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>> >>> i think i missed a step, but witch one? >>> >>> the userpassword hasnt been changed (that would be the next step in the testing process) >>> >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>> >>> please let me know your thougts >>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >>>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >>>> >>>> are you a dovecot devoloper? or a enthusiastic user? >>>> >>>> anyway, i managed to get it working now with all your help :) >>>> >>>> to start fresh i did a: >>>> rm -rf /var/vmail/example.org >>>> >>>> so all email is gone, and i assume all dovecot keys are gone that way. >>>> >>>> Then i tried to set a password first: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: Changed password for 0 key(s) >>>> >>>> (summersun = the password for this user) >>>> >>>> but then it says there are 0 keys, so then i send the test user an email and try to open the >>>> mailbox, i'll get: >>>> >>>> imap(john(a)example.org): Error: read() failed: >>>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >>>> =561:2,) failed: Private key not available: Cannot decrypt key >>>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >>>> routines:BN_mpi2bn:encoding error >>>> >>>> but hey, now the key's are created, so i tried to set the password again: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >>>> failed: password missing >>>> ========= >>>> >>>> Lets start over again, i did a new: >>>> rm -rf /var/vmail/example.org >>>> >>>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >>>> now again new keys are generated. >>>> >>>> then i did set the password via doveadm: >>>> >>>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>>> result: Changed password for 1 key(s) >>>> >>>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >>>> >>>> YESSS!!! >>>> >>>> if i now change the password for the user, i cannot read the email anymore. that is what should >>>> happen. >>>> so now i changed the password for this user also with doveadm: >>>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >>>> >>>> and now i'm able to read the emails again. so it all works now as expected. >>>> >>>> i have now only one thing remaining. >>>> >>>> when i want to add a new user, i have to somehow: >>>> - create the new user in the mysql DB >>>> - start with dovecot not using mail_crypt_private_password (so disabled) >>>> - send an initial email to let the users mailbox be created and generate the keys >>>> - set the users password with doveadm >>>> - restart dovecot again with mail_crypt_private_password (so enabled) >>>> >>>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>>> "add-new-user" script to make it usable i guess. >>>> >>>> do you know of a more easy way of acomplishing this? >>>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>>> >>>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>>> column with %w for users that allready exist, and empty for new users. >>>> when being empty, it might not set the mail_crypt_private_password for new users >>>> >>>> or is this the wrong way of thinking? >>>> >>>> let me know your thoughts on this. >>>> >>>> And last but not least, i really want to thank you for all your help. It is a really nice >>>> experience. >>>> Bless you! >>>> >>>> Zjemm >>> Hi Aki, >>> >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last >>> email i send to you. >>> Maybe you did not received the last email? >>> >>> would you be willing to take a look at my last question in the email See below: >>> Thank you very much. >>> >>> ================================ >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >> If you have mail_crypt_private_password set *when* keys are generated, >> dovecot should use that password to encrypt the user key. >> >> Aki > > Hi Aki, > > well, if there is a new email user setup in the mysql DB, and no email has been send to that new user. at that point there are no keys. > > So trying to set a password on those key's wont work. see: > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n qwerty > result: Changed password for 0 key(s) > > the keys need to be generated first. And that only happens when sending a mail to that new user. Also, at the point of creating the keys, the mail_crypt_private_password should be disabled otherwise the keys are generated and also encrypted with no user password, and then im unable to set a new pasword for that key > > > How can i set the password before the keys are generated? > or can i manually generate key's and then set the password? > > so at this point i have to do the following: You can use doveadm mailbox cryptokey generate -u user -U to generate a user key. Aki >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) > can i somehow enable the mail_crypt_private_password per user? > because this mysql query always returns: %w > and thus allways sets: userdb_mail_crypt_private_password > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users;

1 0

Re: Best mail encryption solution for per-user
by Aki Tuomi 23 May '18

23 May '18

On 23.05.2018 09:13, mail(a)sjemm.net wrote: > May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >> >>>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>>> >>>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>>> >>>> Hi Tai74 and Aki, >>>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>>> I have setup my dovecot with the following in a conf file: >>>> >>>> ============== >>>> >>>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>>> mail_plugins = $mail_plugins mail_crypt >>>> plugin { >>>> >>>> mail_crypt_curve = secp521r1 >>>> >>>> mail_crypt_save_version = 2 >>>> >>>> } >>>> >>>> ============== >>>> >>>> This works nice, all emails are being encrypted and every user/folder has keys. >>>> But as I understood from your conversation these keys are not protected. And I want them to be >>>> protected by the users password used by imap. >>>> >>>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>>> the DB and postfix/dovecot) >>>> >>>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>>> >>>> should i use mail_crypt_private_password = ? >>>> how do i point it to the mysql db then? >>>> im unsure about this >>>> >>>> Do you have any hints on this? >>>> >>>> Kind regards, >>>> Zjemm >>>> >>>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>>> user's keys using user's login password, you must have a TOOL that manages this. >>>> >>>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>>> a good option. >>>> >>>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>>> user changes his password. >>>> >>>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>>> recover the emails without backup copy of the private key. >>>> >>>> Aki >>>> >>>> Hi Aki >>>> >>>> I used the following command: >>>> dovecot pw -s SHA256-CRYPT >>>> >>>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>>> >>>> This output is used to store in the password fields in the database. So no plain text passwords no >>>> :) >>>> >>>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>>> password as private password. >>>> >>>> can you explain this a bit more for me? >>>> >>>> for now i have in the 10-auth.conf file the following: >>>> ============== >>>> passdb { >>>> driver = sql >>>> >>>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>> } >>>> >>>> and: >>>> >>>> userdb { >>>> driver = static >>>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>>> } >>>> ============== >>>> >>>> then i have in dovecot-sql.conf.ext >>>> ============== >>>> driver = mysql >>>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>>> default_pass_scheme = SHA256-CRYPT >>>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>>> ============== >>>> Where do i need to set : mail_crypt_private_password = %w ? >>>> >>>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>>> a good option. >>>> >>>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>>> so this step isnt nesesary anymore am i right? >>>> >>>> Thank you for your quick response, very helpfull >>>> >>>> Zjemm >>>> >>>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>>> password is.. >>>> >>>> So: >>>> >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u' >>>> >>>> Aki >>>> >>>> Hi Aki, >>>> >>>> Thank you very much for your help, i realy appreciate that. >>>> >>>> Ok so if i understand it correctly i'll have to use: >>>> >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u' >>>> >>>> in my dovecot-sql.conf.ext file >>>> >>>> This query selects the user, the password, and %w >>>> >>>> if i run a little query myself: >>>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>>> FROM virtual_users; >>>> +------------------+----------------------------------+------------------------------------+ >>>> | user | password | userdb_mail_crypt_private_password | >>>> +------------------+----------------------------------+------------------------------------+ >>>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>>> +------------------+----------------------------------+------------------------------------+ >>>> >>>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>>> is typing in the password when authenticating. >>>> >>>> is this correct? >>>> >>>> yes. >>>> >>>> so then i have the username the hashed password en the plaintext password as a result of the query. >>>> >>>> yes >>>> >>>> now userdb_mail_crypt_private_password = the plaintext password >>>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>>> >>>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>>> {} section. >>>> >>>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>>> >>>> Thanks again and have a great weekend. >>>> >>>> Zjemm >>>> >>>> Aki >>>> >>>> Hi Aki, >>>> >>>> Cool i'm testing it right now. >>>> I have set up a new mailserver (life is great with lxc containers :) ) >>>> >>>> postfix and dovecot are working like normal >>>> >>>> next i enable mail_crypt >>>> >>>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>>> ========================== >>>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>>> >>>> mail_plugins = $mail_plugins mail_crypt >>>> >>>> plugin { >>>> mail_crypt_curve = secp521r1 >>>> mail_crypt_save_version = 2 >>>> } >>>> ========================== >>>> >>>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>>> >>>> so the query is now the new query: >>>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>>> virtual_users WHERE email='%u'; >>>> >>>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>>> there. >>>> >>>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>>> the mutt client drops the connection. >>>> >>>> in the log i can see: >>>> >>>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>>> failed: >>>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>>> =571:2,) failed: Private key not available: Cannot decrypt key >>>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>>> >>>> i think i missed a step, but witch one? >>>> >>>> the userpassword hasnt been changed (that would be the next step in the testing process) >>>> >>>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>>> >>>> please let me know your thougts >>>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >> >> are you a dovecot devoloper? or a enthusiastic user? >> >> anyway, i managed to get it working now with all your help :) >> >> to start fresh i did a: >> rm -rf /var/vmail/example.org >> >> so all email is gone, and i assume all dovecot keys are gone that way. >> >> Then i tried to set a password first: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: Changed password for 0 key(s) >> >> (summersun = the password for this user) >> >> but then it says there are 0 keys, so then i send the test user an email and try to open the >> mailbox, i'll get: >> >> imap(john(a)example.org): Error: read() failed: >> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >> =561:2,) failed: Private key not available: Cannot decrypt key >> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >> routines:BN_mpi2bn:encoding error >> >> but hey, now the key's are created, so i tried to set the password again: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >> failed: password missing >> ========= >> >> Lets start over again, i did a new: >> rm -rf /var/vmail/example.org >> >> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >> now again new keys are generated. >> >> then i did set the password via doveadm: >> >> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >> result: Changed password for 1 key(s) >> >> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >> >> YESSS!!! >> >> if i now change the password for the user, i cannot read the email anymore. that is what should >> happen. >> so now i changed the password for this user also with doveadm: >> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >> >> and now i'm able to read the emails again. so it all works now as expected. >> >> i have now only one thing remaining. >> >> when i want to add a new user, i have to somehow: >> - create the new user in the mysql DB >> - start with dovecot not using mail_crypt_private_password (so disabled) >> - send an initial email to let the users mailbox be created and generate the keys >> - set the users password with doveadm >> - restart dovecot again with mail_crypt_private_password (so enabled) >> >> but this would be disruptive to existing users, and i would have to script the whole thing as a >> "add-new-user" script to make it usable i guess. >> >> do you know of a more easy way of acomplishing this? >> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >> >> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >> column with %w for users that allready exist, and empty for new users. >> when being empty, it might not set the mail_crypt_private_password for new users >> >> or is this the wrong way of thinking? >> >> let me know your thoughts on this. >> >> And last but not least, i really want to thank you for all your help. It is a really nice >> experience. >> Bless you! >> >> Zjemm > Hi Aki, > > You did fix the posting on the mail archive, i can see our conversation on there, all but the last email i send to you. > Maybe you did not received the last email? > > would you be willing to take a look at my last question in the email See below: > Thank you very much. > > ================================ > i have now only one thing remaining. > > when i want to add a new user, i have to somehow: > - create the new user in the mysql DB > - start with dovecot not using mail_crypt_private_password (so disabled) > - send an initial email to let the users mailbox be created and generate the keys > - set the users password with doveadm > - restart dovecot again with mail_crypt_private_password (so enabled) > > but this would be disruptive to existing users, and i would have to script the whole thing as a "add-new-user" script to make it usable i guess. > > do you know of a more easy way of acomplishing this? > could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > > or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that column with %w for users that allready exist, and empty for new users. > when being empty, it might not set the mail_crypt_private_password for new users > > or is this the wrong way of thinking? > > let me know your thoughts on this. > > And last but not least, i really want to thank you for all your help. It is a really nice experience. > Bless you! > > Zjemm If you have mail_crypt_private_password set *when* keys are generated, dovecot should use that password to encrypt the user key. Aki

1 0