- dovecot - dovecot.org

dovecot - 2 Faktor Auth
by Hajo Locke 30 Nov '17

30 Nov '17

Hallo Liste, hat sich schon mal jemand mit 2 Faktor Auth für dovecot beschäftigt? Es geht dabei nicht nur um die Absicherung einer Weboberfläche sondern direkt die Absicherung der Standard pop/imap Verbindungen des Clients. Wir machen das auth bisher über MySQL. Rein technisch würde das gehen, da man die Password-Query beliebig anpassen und auch mit allow_nets arbeiten kann. Es wäre eher die Herausforderung für den Client den 2. Faktor zu erfüllen und seine IP freizuschalten. Man müsste dann ja Clients wie Thunderbird veranlassen irgendwie die Challenge des 2. Faktors anzuzeigen und zu erfüllen. Vermutlich kann man das nur mit speziellen Clients z.B. einer eigenen App machen. Hat jemand in dem Bereich Erfahrung und kann diese teilen? Danke, Hajo

2 1

ManageSieve: authenticate "EXTERNAL" not behaving correctly
by Marc Weustink 30 Nov '17

30 Nov '17

Hi, I've enabled client certificate authentication for imap and managesieve. When I use Thunderbird with the sieve plugin it tries to login, but times out. Initially I reported this to the sieve plugin, but we came to the conclusion that it managesieve is misbehaving. https://github.com/thsmi/sieve/issues/94 Thunderbird (win10-64) 52.4.0 (32bit) Sieve 0.2.3k Dovecot (Ubuntu 16.04.3 LTS) 2.2.33.1-1 (sid) What happens is the following (p=plugin sends m=managesieve sends) p:authenticate "EXTERNAL" "" m:"" The response is unexpected. According to RFC 5804 an empty challenge/response is sent as an empty string. So I would expect: p:authenticate "EXTERNAL" "" m:OK "Logged in." With the use of gnutls-cli I could reproduce (c=I send m=managesieve sends) gnutls-cli --starttls --x509keyfile marc_mail.key --x509certfile marc_mail.crt -p sieve 172.17.1.4 ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "" m:"" c:"" m:OK "Logged in." However if I try the "imap" syntax (rfc4959) I get logged in at once ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "=" m:OK "Logged in." Note that this is an imap only extention, "=" is an invalid base64 encoding. Marc

2 4

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

On 30/11/17 03:03, Robert Giles wrote: >> David, >> >> I'd say that if you set the mail_max_userip_connections value to a >> large-ish number (300-400), your users likely won't notice an issue on >> their iOS 10.x and iOS 11.x devices.? It's more of an annoyance in the >> logs, and occasionally the iOS Mail app will show that it is stuck >> checking mail for a few minutes (when the new max_userip_connections is >> reached again, but with a large number, it happens much less frequently). >> >> Keep in mind max_userip applies to *authenticated* users, so a true, >> malicious DoS situation is less likely. Maybe not malicious DoS, but if your running a shared platform, or supports hundreds of users using Apple products, you can do the arithmetic and see that you can run into problems with resource starvation. >> And yeah, I'm definitely tired of Apple going off and breaking their >> software, because the blame always comes back on IT instead of Apple :( Apple, are you listening? Would it kill you to design your software not to treat remote mail servers like personal servers that can serve up connections like candy? (I also see that some iOS clients keeps an open SMTP connection on standby, even though it's not sending mail.) Joseph Tam <jtam.home(a)gmail.com>

1 0

iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

I frequently see this from my iPhone/iPad IMAP users: Oct 24 21:30:55 server dovecot: imap-login: Login: user=<user>, ... [... repeated 10 times ...] Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> Oct 24 21:32:54 server dovecot: imap(user): Logged out ... [... repeated 11 times ...] These bursts of logins/max/logouts would cycling on for a few minutes. Googling this problem seems to turn up lots of similar complaints about iOS mail mail clients. e.g. https://discussions.apple.com/thread/2547839?tstart=0 iOS mail readers do not limit connections limit as other mailreaders can. I could increase mail_max_userip_connections, but that just moves the goal posts. Using the new rawlog feature in 2.2.26 (thanks Dovecot team!), I was able to see that these connection bursts are caused by clients doing global searches. The rawlogs show each mailbox being SELECT'd and searched (e.g. From header string): 1477369968.730450 2 ID ("name" "iPad Mail" "version" "13G36" "os" "iOS" "os-version" "9.3.5 (13G36)") 1477369968.781932 3 SELECT {mailbox} 1477369968.961636 4 UID SEARCH RETURN (COUNT) 1:* NOT DELETED 1477369969.006087 5 UID SEARCH RETURN (ALL) 1:* NOT DELETED 1477369969.052701 6 UID SEARCH RETURN (ALL) {search-term} NOT DELETED 1477369974.624153 7 LOGOUT Questions: 1) How does this affect the user? I heard from one user that it makes global searches unusable because his reader just spins its wheel. I'm not sure whether this is impatience or this results in failed searches. 2) Is there a client-side fix (e.g. connection limiting)? Apple appears to be intransigent on addressing this. 3) Will maintaining search indices (e.g. solr) help with this? Maybe the searches are taking too long and the connections pile up waiting for previous searches to finish. Thanks, Joseph Tam <jtam.home(a)gmail.com>

3 2

XDOVECOT capability?
by Hogne Vevle 28 Nov '17

28 Nov '17

Hi! Here and there, I'm seeing mentions of a "XDOVECOT" capability - e.g. on https://documentation.open-xchange.com/7.8.2/middleware/components/search/c… . However, I can't seem to find any documentation on what this actually does. We need to add this capability to our servers in order for certain functionality of Open Xchange App Suite to work properly (as seen in the link above), but we don't want to blindly update our entire Dovecot cluster just because their docs tell us to :) Can someone, please, shed some light on what other effects we can expect to see after enabling this capability, if any? Or is it simply a way of telling clients that "Hey, I'm a Dovecot server" - nothing else? Cheers, - Hogne

2 1

How to make dovecot access a MySQL database with a certain domain?
by Spike98 28 Nov '17

28 Nov '17

I am trying to make a mail server with Postfix using the Dovecot software. At the time of wanting to access my server from a mail client, it does not let me access and see the logs of my server with the command: $ service dovecot status with the following error: dovecot: auth-worker(2769): Error: mysql(127.0.0.1): Connect failed to database (postfix): Access denied for user 'postfix'@'localhost' (using password: YES) - waiting for 125 seconds before retry From what I understand of this error is that it is trying to enter 'postfix' @ 'localhost' instead of the domain that I specify when I made the database that is mydomain.com How can you make dovecot go to MySQL with postfix(a)mydomain.com instead of localhost This is my Dovecot configuration /etc/dovecot/dovecot-sql.conf.ext driver=mysql default_pass_scheme=PLAIN-MD5 connect=host=127.0.0.1 dbname=postfix user=postfix password=postfix password_query=SELECT username,domain,password FROM usuarios WHERE username='%n' AND domain='%d' user_query=SELECT 1007 as uid, 1007 as gid, concat("maildir:/var/vmail",domain,'/',username,'/') as mail FROM usuarios WHERE username='%n' AND domain='%d' iterate_query=SELECT username,domain FROM usuarios

3 2

Imapsieve plugin?
by Bruce 28 Nov '17

28 Nov '17

Debian stretch. Dovecot 2.2.27 I was working with a document that references the imapsieve plugin. It references the /etc/dovecot/conf.d/90-imapsieve.conf file. The only reference I've found for it is https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/IMAPSieve#Configuration. I've got dovecot-managedsieve and dovecot-sieve already installed. Am I missing something obvious here? Bruce M.

2 2

Re: Server migration
by Joseph Tam 27 Nov '17

27 Nov '17

> I've asked this before, but now it's time to move one server to > another, I can't delay the operation anymore (the older server is > failing) > > Both server are pretty old: 1.2.15 > > Probably, faster way would be to rsync all mailboxes from the older > server to the newer one. I can start migrating everything while > running then, stop the older server and sync only what is changed, > keeping downtime at minimum. > > Any better solution ? It depends on your situation. If you only have a small userbase with modest amount of mail, you can probably take your whole system down, do a one time migration, then cut over to the new system without too much downtime. If you have medium sized operation, then what you propose above would work. If you have a large userbase (or large user mailboxes), or you want to minimize downtime, you can incrementally migrate per user so that any particular user experiences a small window of outage, but the system is online for everybody else. This, of course, requires a lot more setup and planning. Joseph Tam <jtam.home(a)gmail.com>

1 0

lmtp-Eroor
by Jakob Schürz 27 Nov '17

27 Nov '17

Hi There! I can not find anything about this message: dovecot[23202]: lmtp(jakob): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: header Message-ID (Cache file is unusable) dovecot[23202]: lmtp(jakob): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: virtual size (Cache file is unusable) And the next is: dovecot[23202]: lmtp(jakob): rphlK01SG1qiWgAAk1Mx3g: sieve: msgid=<E1eJ6cv-000624-Je(a)xxx.xxxxxxx.xxx>: stored mail into mailbox 'INBOX/TESTORDNER' It happens when a mail gets delivered through lmtp. My exim-Transport is this: dovecot_lmtp: driver = lmtp socket = /var/run/dovecot/lmtp #maximum number of deliveries per batch, default 1 batch_max = 200 And my dovecot-Conf is this: # dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.13.0-trunk-amd64 x86_64 Debian 9.1 btrfs auth_debug = yes auth_mechanisms = plain login cram-md5 digest-md5 auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes first_valid_uid = 1000 imap_capability = +XDOVECOT imap_client_workarounds = tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = *, ::1 login_trusted_networks = 127.0.0.1/8 192.168.0.0/24 192.168.1.0/24 172.17.0.0/24 172.18.0.0/24 mail_debug = yes mail_gid = vmail mail_home = /var/mail/%u mail_location = maildir:/var/mail/%u/Maildir:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/Maildir/%u:INDEXPVT=/var/lib/dovecot/db/indexes/Maildir/%u:CONTROL=/var/lib/dovecot/db/control/Maildir/%u mail_plugins = zlib quota acl listescape mail_log notify virtual mail_privileged_group = vmail mail_server_admin = mailto:jakob@xundeenergie.at mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { hidden = no inbox = no list = children location = maildir:/var/mail/mailarchiv/%u/:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/mailarchiv/%u:INDEXPVT=/var/lib/dovecot/db/indexes/mailarchiv/%u mailbox incoming { auto = create } mailbox outgoing { auto = create } prefix = Mailarchiv/ separator = / subscriptions = no type = private } namespace { list = children location = maildir:/var/mail/public/:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/public/%u:INDEXPVT=/var/lib/dovecot/db/indexes/public/%u prefix = Roseggergasse/ separator = / subscriptions = no type = public } namespace Geteilt { hidden = no inbox = no list = children location = maildir:/var/mail/%%u/Maildir:LAYOUT=fs:INDEXPVT=/var/lib/dovecot/db/indexes/shared/%u/%%u:INDEX=/var/lib/dovecot/db/indexes/shared/%u/%%u prefix = Geteilt/%%n/ separator = / subscriptions = no type = shared } namespace Real { hidden = yes list = no location = virtual:/var/mail/real:INDEX=/var/lib/dovecot/db/indexes/real/%u prefix = Real/ separator = / subscriptions = no } namespace Synoptic { hidden = no list = children location = virtual:/var/mail/virtual:INDEX=/var/lib/dovecot/db/indexes/virtual/%u mailbox INBOX/Archives { auto = no special_use = \Archive } mailbox INBOX/Drafts { auto = no special_use = \Drafts } mailbox INBOX/Entwürfe { auto = no special_use = \Drafts } mailbox INBOX/Junk { auto = no special_use = \Junk } mailbox INBOX/Spam { auto = no special_use = \Junk } mailbox Sent { auto = no special_use = \Sent } prefix = Synoptic/ separator = / subscriptions = no } namespace inbox { hidden = no inbox = yes location = mailbox Archiv { auto = no special_use = \Archive } mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = no special_use = \Drafts } mailbox Entwürfe { auto = no special_use = \Drafts } mailbox "Gelöschte Elemente" { auto = no special_use = \Trash } mailbox "Gelöschte Objekte" { auto = no special_use = \Trash } mailbox Gesendet { auto = no special_use = \Sent } mailbox "Gesendete Elemente" { auto = no special_use = \Sent } mailbox "Gesendete Objekte" { auto = no special_use = \Sent } mailbox Important { auto = no } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Mistkübel { auto = no special_use = \Trash } mailbox Papierkorb { auto = no special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no special_use = \Junk } mailbox Synoptic/Alle { auto = no comment = All my messages special_use = \All } mailbox Trash { auto = no special_use = \Trash } mailbox Wichtig { auto = create } prefix = INBOX/ separator = / subscriptions = no type = private } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions = yes } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_decoder = decode2text.sh fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball mail_home = /var/mail/%u setting_name = sieve, managedsieve sieve = file:/var/mail/%u/sieve/;active=/var/mail/%u/sieve/%u.sieve } postmaster_address = postmaster@localhost protocols = " imap lmtp sieve pop3 sieve" service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service auth { unix_listener auth-client { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 service_count = 1 } service imap { executable = imap postlogin process_limit = 1024 vsz_limit = 400 M } service lmtp { user = vmail vsz_limit = 400 M } service postlogin { executable = script-login -d rawlog } ssl = required ssl_cert = </etc/dovecot/dovecot.crt ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it ssl_protocols = TLSv1.2 TLSv1.1 TLSv1 !SSLv3 userdb { args = username_format=%u /etc/dovecot/users default_fields = home=/var/mail/%u driver = passwd-file } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = zlib quota acl listescape mail_log notify virtual quota sieve acl } protocol lda { mail_plugins = zlib quota acl listescape mail_log notify virtual quota sieve acl } protocol imap { mail_max_userip_connections = 10 mail_plugins = zlib quota acl listescape mail_log notify virtual imap_quota imap_acl }

3 6

doveadm backup or sync Read status
by DurgaPrasad - DatasoftComnet 27 Nov '17

27 Nov '17

Hello All, Sorry for reposting. Earlier I was in digest mode hence could not update the previous post. I am trying to migrate mail from a dovecot-2.0.13-1_129.el5 maildir to dovecot-2.2.10-8.el7.x86_64 centos 7 mdbox. I am using this command doveadm -v -o mail_fsync=never backup -R -u user(a)domain.com imapc: also tried doveadm -v -o mail_fsync=never sync -1 -R -u user(a)domain.com imapc: Both work flawlessly - Timo is great !!! - My issue is the source folders are all marked as read. The target folders of-course have unread OK. POP3 UIDLs are also ok (tested for one user). (1) My question is how can I make the source remain same (unread status etc.) so that I do migrate the various domains in a transparent manner and then switch servers ?. I have multiple virtual domains. (2) One more question do I have to do both imapc_ & also pop3c_ migration since I need the POP UIDLs to work properly for my outlook POP3 users after migration ?. I want to know the possibilities. Thanks DP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0