- dovecot - dovecot.org

fail2ban / ldap login failure
by micha＠micha.waw.pl 05 Aug '23

05 Aug '23

[Debian Bookworm + Dovecot 2] I have user database in ldap (samba). I want to use fail2ban to restrict unsuccessful login attempts, but... I cannot see "Authentication failure" message in ANY log. (/var/log/mail.log shows successful logins as well as disconnects.) How should I proceed?

2 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

Using / in folder names
by Scott 04 Aug '23

04 Aug '23

Is this possible at all ? I am trying to import a PST file and it has a slash in the folder name. Dovecot errors out with : APPEND "Caixa de Entrada_VIDA/S1" (\Seen) NO [CANNOT] Invalid mailbox name: Name must not have '/' characters My namespace separator is the dot and I configured the listescape plugin to escape / but it still doesn't work. The listescape documentation says: The / character is disallowed on POSIX systems. This plugin allows you to use all of these characters, as long as the virtual separator (i.e. what is set by the separator setting and used as such by the IMAP protocol) is changed to something else, which means that the plugin does not make it possible to use the virtual separator in folder names. So it seems that as long as I use the dot, it should work ? Except it doesn't... How can I do this import ? Thank you!

3 9

RE: Forcing imap authentication failure for certain IP addresses
by aki.tuomi 02 Aug '23

02 Aug '23

One way is to use https://doc.dovecot.org/configuration_manual/authentication/auth_policy/or you can use passdb { driver = passwd-file deny = yes args = username_formar=%{rip} /etc/dovecot/deny.ip}or you can use https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… write this in Lua.Aki -------- Original message --------From: Hippo Man <hippoman(a)gmail.com> Date: 8/1/23 18:14 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Forcing imap authentication failure for certain IP addresses I'm running dovecot 2.3.18 under Debian 11.I want to do something that's a bit unusual: when IMAP connections are attemptedfrom a few specific IP addresses, I want to force an IMAP authentication failurefrom those connections, no matter what user ID and password are specified.I know that I can use iptables to completely block imap access from those IPaddresses to the IMAP ports. However, in these specific cases, I'd prefer thatthe connection goes through to dovecot, but for dovecot then to always generateauthentication failures for those specific connections ... even if a validuser ID and password happen to be specified.Is there a way to do this in dovecot?Thank you very much in advance.-- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

3 5

sieve passing body as arguments to executed script
by Jonathan Davis 02 Aug '23

02 Aug '23

I ran into an issue when trying to wildcard match the email body where the variable was empty, which lead me to extracttext and forverypart, however I am running into an odd error. When I deliver an email with the body of 'this is the body text of email' it dies with the following error: sogo: line 236: error: specified :args item `this is the body text of email??' is invalid The sieve in question: if header :matches "Subject" "*" { set "emailsubject" "${1}"; } if header :matches "From" "*" { set "emailfrom" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 80 "emailbody"; break; } } execute "script.php" ["${emailfrom}", "${emailsubject}", "${emailbody}"]; I tried downloading the log to see if ?? was a character not rendering correctly in console, but local text editors show the same. I'm not sure where it is coming from or what it is. I tried :quotewildcard with set :quotewildcard "quotedbody" ${emailbody}"; And passed "${quotedbody}" as an argument, however the same error was appearing in the logs. If I'm approaching this problem incorrectly, the end result is I want to pass the entire contents of the email to the script. - Jonathan

1 0

Postlogin script ACL_GROUPS from LDAP
by Andrzej Milewski 01 Aug '23

01 Aug '23

Hello, I am testing the Dovecot mail server with the iRedMail configuration. My backend is based on LDAP. I would like to set up the "Public" folders in such a way as to grant permissions to specific groups of users. To achieve this, I created the following entry in the configuration: acl = vfile:/etc/dovecot/dovecot-acl-global:cache_secs=300 For individual users, the global permissions work correctly, and I achieve what I want. However, I am unsure how to grant permissions for a group. Specifically, I know that I should include permissions for groups in this file, for example: Public/ anyone l Public/IT_Suwalki group=grupa1 lrwstipek Public/IT_Suwalki/* group=grupa1 lrwstipekxa But I don't know how to associate users with groups. From what I managed to figure out, the user should have the "ACL_GROUPS=grupa1,grupa2" variable, and it should be passed by the postlogin script. But how can I do that? Do you have any working example of such a script? Which LDAP attributes should this script utilize? In my LDAP, there is an attribute called "memberOfGroup"; can I use it? Thank you for all the suggestions. -- Andrzej Milewski andrzej.milewski(a)gmail.com tel. 0603957324

1 0

Imaptest sigfault error
by DeJa Wu 31 Jul '23

31 Jul '23

I Tried to run the test with imaptest and got a segfault error. Debug: Reading symbols from imaptest...done. (gdb) run user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining Starting program: /usr/bin/imaptest user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Logi Sele Logo 100% 100% 100% 179 163 154 551/637 [0%] 245 247 250 1153/1372 [1%] 238 240 238 1725/2086 [2%] 213 215 219 2250/2725 [2%] 213 209 203 2760/3364 (263 stalled >3s) [3%] 220 226 228 3308/4024 (854 stalled >3s) [4%] 247 245 247 3870/4765 (1338 stalled >3s) [4%] 239 237 239 4414/5482 (1800 stalled >3s) [5%] 259 257 259 4998/6259 (2299 stalled >3s) [6%] 270 274 271 5599/7069 (2809 stalled >3s) [7%] 3843 46 26 ms/cmd avg Logi Sele Logo 100% 100% 100% 243 242 237 6122/7798 (3369 stalled >3s) [7%] 242 239 237 6697/8524 (3937 stalled >3s) [8%] 241 241 248 7251/9247 (4542 stalled >3s) [9%] 229 231 234 7776/9934 (5143 stalled >3s) [9%] 230 228 225 8332/10624 (5800 stalled >3s) [10%] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f1745f in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 How can I fix this?

2 1

Notification "API" for external replication
by Heiko Schlittermann 31 Jul '23

31 Jul '23

Hi Aki and all the Dovecot team, thank you for your work on Dovecot. As the "built-in" replication is going to cease (I do not want to discuss the reasoning or any judgement here): Can you (the Dovecot developers) ensure that a kind of "notification socket"¹ will be there, even if you do not provide a the replicator feature? And - but that's already a feature request - could you use this (or an other socket) for notifications on sieve script changes? I can imagine using this socket as an "official" interface to external software. Actually that would implicate that the notification messages are documented and stable, but I'm sure, this would be possible (if not done already). ¹) That is how I understand the current mechanism of the replication: the replicator gets a notification via the socket and starts replicating the mailbox. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 1

Accessing SSL parameters via dovecot variables
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, Dovecot supports variables, which can be used in filters. Does the SSL code expose variables linked to the client certificate? The answer today appears to be no, and if that’s true I plan to patch it, but just need to confirm I am not missing something. Regards, Graham —

2 2

Filtering by SASL auth mechanism
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I want dovecot to behave differently depending on what SASL mechanism was used. Most specifically, if EXTERNAL, I want auth_ssl_username_from_cert to be yes, but no otherwise. There is a filtering mechanism that supports protocol, remote, etc. https://doc.dovecot.org/configuration_manual/config_file/ Would it make sense to add a SASL mechanism filter like this: mechanism external { # … } Regards, Graha —

1 0