- dovecot - dovecot.org

Disable ssl validation for replication?
by Joseph Ward 24 Dec '17

24 Dec '17

Hi, I have two servers (HA configuration) on which I'm attempting to get replication working over SSL. They're at two different sites, but connected via a site-site VPN. Everything seems to be fine, except that the certificates are not validating as I'm using IP addresses for the sync, as opposed to the public hostnames for which the certificates are valid, and so I get the following error: doveadm(user@domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name 10.x.x.x I'm on Dovecot 2.2.33. Is there any way to disable the certificate checking/validation for the sync engine? ( I'm aware of at least a couple of fallback options: -have a self-signed cert for replication and use the Let's Encrypt one for IMAP/POP - create firewall rules allowing them to connect to each other over the public internet so that it can validate the proper cert These are both much less palatable than simply disabling the cert validation if it's possible. ) Thank you in advance for any assistance, Joseph

3 3

sieve_pipe_socket_dir not created at startup for configured pipe service
by Garth Corral 24 Dec '17

24 Dec '17

Hi, all I’m new to the list but not to dovecot. I’ve been using it in a basic configuration for some time, but finally decided to tweak my deployed system to take advantage of some more dovecot features. In particular I’m trying to set up pigeonhole to implement spam retraining with imapsieve. All of this is with dovecot 2.2.31 (65cde28) and pigeonhole 0.4.19. Before going any further let me start by saying that I have gotten all of this to work. It works when I can get dovecot to start up, that is. My configuration is pretty much straight from the docs, with a few tweaks for my particular needs. I’m trying to set up a pipe service using sieve-extprograms, and the relevant part of my config looks like this: plugin { sieve_pipe_input_eol = lf sieve_pipe_socket_dir = sieve-pipe sieve_filter_socket_dir = sieve-filter sieve_execute_socket_dir = sieve-execute sieve_pipe_bin_dir = /usr/local/libexec/dovecot/sieve-pipe sieve_filter_bin_dir = /usr/local/libexec/dovecot/sieve-filter sieve_execute_bin_dir = /usr/local/libexec/dovecot/sieve-execute } service sieve-train-ham { executable = script /usr/local/libexec/dovecot/sieve-pipe/train-ham.sh # Needs access to dspam config and lockfiles. user = dspam # socket name is program-name in Sieve (without sieve-pipe/ prefix) unix_listener sieve-pipe/train-ham { } } It’s my understanding from reading the docs that the sieve_pipe_socket_dir specifies a directory that is relative to base_dir, which is the default /var/run/dovecot in my case. The issue I’m having is that dovecot will not start, and spews the following errors: dovecot: master: Error: bind(/var/run/dovecot/sieve-pipe/train-ham) failed: No such file or directory dovecot: master: Fatal: Failed to start listeners Once dovecot fails startup, it leaves /var/run/dovecot around and if I manually create the sieve-pipe directory there it will start up, create the sockets there and everything works as intended subsequently. The problem, though, is that on normal shutdown all of /var/run/dovecot goes away and the at the next startup it fails to start again. Needless to say this isn’t great for unintended reboots, etc. So, can anyone see anything obvious that I’m doing wrong? I’m just assuming that dovecot should create the needed subdir since I can’t find anything in the docs to suggest a way to create it otherwise. I’ve tried all I can think of at the moment to try to remedy this without success. I’m happy to provide additional details as needed to try to track this down. Thanks in advance, Garth

3 3

Dovecot 2.3-rc Logging Format
by Thomas Leuxner 24 Dec '17

24 Dec '17

Hi, the release candidate defaults to a log format with session IDs. mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " As the LMTP service seems to have the session ID hardcoded, the IDs get duplicated in the logs: Dec 21 08:48:03 edi dovecot: lmtp(26573): Connect from local Dec 21 08:48:03 edi dovecot: lmtp(tlx(a)leuxner.net)[26573]: <fCVaBjNnO1rNZwAAIROLbg>: fCVaBjNnO1rNZwAAIROLbg: sieve: msgid=<2323281.OorJHhdMHM@ylum>, time=158ms, status=stored mail into mailbox ':public/Mailing-Lists/Debian-User' Dec 21 08:48:03 edi dovecot: lmtp(26573): Disconnect from local: Client has quit the connection (state = READY) Regards Thomas

3 2

Released Pigeonhole v0.5.0 for Dovecot v2.3.0.
by Stephan Bosch 24 Dec '17

24 Dec '17

Hello Dovecot users, Here's the definitive 0.5.0 release. There is one RC fix regarding the duplicate presence of the session ID in the LMTP/LDA log lines produced by the Sieve interpreter. Since this change is relative to the RC, it is not in the change log below. Changelog v0.5.0: * editheader extension: The implementation of header modifications is heavily updated. Although the functionality has not changed, the underlying code was updated to address several static analysis warnings, runtime integer arithmetic warnings (Clang), and to match updates in the Dovecot stream API. + variables extension: Made the maximum scope and variable size configurable. + subaddress: Support multiple recipient_delimiters. - enotify extension: mailto method: Fixed parsing of mailto URI with only a header part. - enotify plugin: mailto method: Make sure the "From:" header is set to a usable address and not "(null)". - Fixed writing address headers to outgoing messages. Sometimes headers were MIME-encoded twice, yielding invalid results. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.0.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.0.ta… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Dovecot 2.3-rc1 SMTP submission proxy always gives TLS required error even when already using TLS
by Michael Marley 23 Dec '17

23 Dec '17

First of all, I apologize for my accidental empty message earlier. I just set up the SMTP submission proxy in Dovecot 2.3, but whenever I try to connect to it, it always returns "530 5.7.0 TLS required." for any sort of AUTH or MAIL command. This occurs even if TLS is being used. It also occurs regardless of whether I connect with a real client (Thunderbird) or manually with openssl s_client and regardless of whether a loopback connection or a remote connection is used. Here is the output of "dovecot -n". Please let me know if I can provide any other data. Thanks! # 2.3.0.rc1 (12aba5948): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0.alpha1 (f60f2785) # OS: Linux 4.14.7-041407-generic x86_64 Ubuntu Bionic Beaver (development branch) auth_mechanisms = plain login auth_username_format = %Ln mail_location = mdbox:~/mdbox managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = michael(a)michaelmarley.com protocols = imap sieve lmtp submission service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 0 } } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/ssl/private/michaelmarley.com.pem ssl_cipher_list = HIGH !RC4 !aNULL !eNULL !3DES @STRENGTH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_relay_host = localhost submission_relay_port = 24 submission_relay_trusted = yes userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } local_name matthewtmarley.com { ssl_cert = </etc/ssl/private/matthewtmarley.com.pem ssl_key = # hidden, use -P to show it }

2 4

Pigeonhole implicit keep gets unfiltered message
by Adam Weinberger 23 Dec '17

23 Dec '17

I'm getting a behaviour with pigeonhole that I wasn't expecting. Am I misunderstanding the design? I run my messages through a vnd.dovecot.filter. It's essentially this: filter "spam_filter"; if spamheaders { fileinto "spam"; stop; } Mail stored in the spam folder is the filtered version, but the implicit-keep message is the original, unfiltered message. If I add an explicit `keep;` to the end, it stores the filtered version into my inbox. Based on the filter RFC, I was expecting the implicit keep to retain the filtered version. Am I misinterpreting the spec? # Adam -- Adam Weinberger adamw(a)adamw.org http://www.adamw.org

2 4

Re: Lua Auth
by Mark Moseley 23 Dec '17

23 Dec '17

> > > > > 2) Is there an appropriate way to return data with spaces in it (or > presumably other non-alphanum chars. My quota name had a space in it, > which > somehow got interpreted as 'yes' , i.e.: > > imap: Error: Failed to initialize quota: Invalid quota root quota: Unknown > quota backend: yes > > I simply changed the space to an underscore as a workaround, but I'm > curious if there's a better way. I tried various quoting without success. > Didn't try escaping yet. > > > 2) Instead of string, return a key value table. you can have spaces in > values. > > > Does this work for auth_passdb_lookup too, or just auth_userdb_lookup? I've been returning a table with auth_userdb_lookup just fine. But when I try using it with passdb (and despite being very very sure that a 'password' key exists in the table I'm returning from auth_passdb_lookup() -- I'm logging it one line above the return), the passdb auth fails with this log entry: Dec 21 23:29:22 auth-worker(7779): Info: lua(test1(a)test.com,10.20.103.32,<dSvLQuZg+uIKFGcg>): No password returned (and no nopassword) I guess it's not seeing the password key in the table I'm returning. If I return a concat'd string ("password=... user=...") from auth_passdb_lookup(), it works just fine. I was also curious if there's a way to pass info between auth_userdb_lookup and auth_passdb_lookup. I was trying to use a table with auth_passdb_lookup() so I could take advantage of prefetch and thought that if auth_passdb_lookup didn't take a table, I could stash data away and then un-stash it in auth_userdb_lookup Thanks! > 3) response_from_template expands a key=value string into table by var > expanding values. > > > var_expand can be used to interpolation for any purposes. it returns a > string. see https://wiki.dovecot.org/Variables for details on how to use > it. > > > Individual variable access is more efficient to do directly. > > > --- > Aki Tuomi >

3 5

ot: how to block persistent same invalid account, different IPs
by Joseph Tam 22 Dec '17

22 Dec '17

"Voytek Eymont" <voytek(a)sbt.net.au> > I've installed fail2ban, it seems to be working as it identified my failed > test logins, BUT, my question is: > > what can I do when I see same invalid name trying to login to dovecot, > different IP each time, how can I say block each IP as used by this name ? If each IP is only used once in a long while, what would be the point? In general, distributed attacks are very hard to stop if you have a default accept stance. I've observed that most of the attacks to my site are from the enormous Chinese stated owned public network superblocks. I finally got sick of them so I now spiral these IMAP/POP connections into the Scharwzschild radius of my firewall. It's a prophylactic measure and not a reactive system like fail2ban, and may not work for you if you got road warriors that frequent that part of the world. However, it did get rid of a metric ton of BFD connections. Joseph Tam <jtam.home(a)gmail.com>

1 0

ot: how to block persistent same invalid account, different IPs
by Voytek Eymont 22 Dec '17

22 Dec '17

I've installed fail2ban, it seems to be working as it identified my failed test logins, BUT, my question is: what can I do when I see same invalid name trying to login to dovecot, different IP each time, how can I say block each IP as used by this name ? or it that a bad idea ? I can see two persistent attempts as so: I don't have such user 'ignacio' or 'julian' # grep ignacio.munoz /var/log/dovecot.log | wc 178 3436 35624 # grep ignacio.munoz /var/log/dovecot.log | grep 'auth fail' | wc 178 3436 35624 # grep julian /var/log/dovecot.log | wc 178 3432 34321 # grep julian /var/log/dovecot.log | grep 'auth fail' | wc 178 3432 34321 last 6 tries, sometimes have just : <ignacio.munoz>, sometimes, with tld Dec 22 17:00:33 imap-login: Info: Disconnected (auth failed, 1 attempts in 8 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=157.122.183.218, lip=163.47.110.6, TLS, session=<Z4JniOdgkgCderfa> Dec 22 17:01:06 imap-login: Info: Disconnected (auth failed, 1 attempts in 7 secs): user=<ignacio.munoz>, method=PLAIN, rip=60.172.162.2, lip=163.47.110.6, TLS, session=<CsdriudgWAA8rKIC> Dec 22 18:58:26 imap-login: Info: Disconnected (auth failed, 1 attempts in 10 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=60.30.224.189, lip=163.47.110.6, TLS: Disconnected, session=<kvLWLelg0QA8HuC9> Dec 22 18:58:59 imap-login: Info: Disconnected (auth failed, 1 attempts in 7 secs): user=<ignacio.munoz>, method=PLAIN, rip=220.164.2.138, lip=163.47.110.6, TLS: Disconnected, session=<T7T5L+lgRADcpAKK> Dec 22 19:30:28 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<ignacio.munoz(a)aaa.com>, method=PLAIN, rip=113.8.194.3, lip=163.47.110.6, TLS, session=<jfSgoOlgswBxCMID> Dec 22 19:31:09 imap-login: Info: Disconnected (auth failed, 1 attempts in 6 secs): user=<ignacio.munoz>, method=PLAIN, rip=58.210.119.226, lip=163.47.110.6, TLS, session=<moAVo+lg8gA60nfi> -- Voytek

3 2

New Dovecot service: SMTP Submission (RFC6409)
by Stephan Bosch 22 Dec '17

22 Dec '17

Hi, As some of you know, I started implementing the SMTP submission proxy a few years ago. It acts as a front-end for any MTA, adding the necessary functionality for an SMTP submission service, also known as a Mail Submission Agent (MSA) (https://tools.ietf.org/html/rfc6409) The main reason I created this, back then, was implementing the BURL capability (https://tools.ietf.org/html/rfc4468) The main application of that capability -- together with IMAP URLAUTH -- is avoiding a duplicate upload of submitted e-mail messages; normally the message is both sent through SMTP and uploaded to the "Sent" folder through IMAP. Using BURL, the client can first upload the message to IMAP and then use BURL to make the SMTP server fetch the message from IMAP for submission, thereby avoiding a second upload. Apart from BURL, the submission proxy service also adds the required AUTH support, avoiding the need to configure the MTA for SASL authentication. More SMTP capabilities like CHUNKING and SIZE are supported, without requiring the backend MTA supporting these extensions. Other capabilities like DSN currently require support from the backend/relay MTA. At this point, the submission proxy is still pretty basic. However, it will provide a basis for adding all kinds of functionality in the (not so distant) future. For the first time, it will be possible to act upon message submission, rather than only message retrieval; e.g. plugins can be devised that process outgoing messages somehow. Examples of the things we could do are adding Sieve filtering support for outgoing messages, or implicitly storing submitted messages to the Sent folder. Once a plugin API is devised, you can create your own plugins. The reason I send this message now, is that this code is finally merged into the Dovecot master repository. This means that it is part of the upcoming 2.3 release. Now that it is merged, you can install and test it from Github if you like. Feedback is of course appreciated. The documentation is still pretty sparse, but there is currently not much to configure. Just add "submission" to the protocols and configure the relay MTA server. The configuration is currently only documented in the example configuration in doc/example-config/conf.d/20-submission.conf. The submission service is a login service, just like IMAP, POP3 and ManageSieve, so clients are required to authenticate. The same authentication configuration will also apply to submission, unless you're doing protocol-specific things, in which case you may need to amend your configuration for the new protocol. BURL support requires a working IMAP URLAUTH implementation. I've updated the automated Xi Debian package builder to create an additional dovecot-submissiond package. So, if you're using the Xi packages, you only need to install that package and configure the relay MTA. Regards, Stephan.

7 16