- dovecot - dovecot.org

Can Dovecot reject unencrypted mail?
by David Seaward 10 Jan '18

10 Jan '18

Hi, Is it possible to configure Dovecot to reject mail that is not encrypted. In other words: 1. If the user tries to send an unencrypted message from their MUA, the server rejects it. 2. If a third-party tries to send an unencrypted message to the user, the server rejects it. The end result would be that no mail stored on the server can be decrypted by the administrator. I am aware that: * "Encrypted" could mean a lot of things. I'm imagining GPG encryption, but am open to other supported methods. * This configuration would not suit everyone, e.g. someone posting to a public mailing list :) Regards, David

3 2

Re: Can Dovecot reject unencrypted mail?
by Ryan Beethe 10 Jan '18

10 Jan '18

Hi David, I don't know how to do what you want with dovecot, but what you are asking is easy and straightforward with Postfix. Postfix can easily be configured to feed mail through a milter ("mail filter") interface. You would just need to write a milter (there is a nice python library) that checks if the messages is "encrypted" to your specifications and tells Postfix to bounce the message if its not. This would be a nice backscatter-free solution. After you have the milter written, you specify it with the "smtpd_milters" option for Postfix. Ryan On Wed, Jan 10, 2018 at 02:08:38PM +0200, David Seaward wrote: > Hi, > > Is it possible to configure Dovecot to reject mail that is not > encrypted. In other words: > > 1. If the user tries to send an unencrypted message from their MUA, > the server rejects it. > > 2. If a third-party tries to send an unencrypted message to the user, > the server rejects it. > > The end result would be that no mail stored on the server can be > decrypted by the administrator. > > I am aware that: > > * "Encrypted" could mean a lot of things. I'm imagining GPG > encryption, but am open to other supported methods. > > * This configuration would not suit everyone, e.g. someone posting to > a public mailing list :) > > Regards, > David >

1 0

openssl question
by Selcuk Yazar 10 Jan '18

10 Jan '18

Hi we are using dovecot on secure port when i try to command openssl s_client -connect mail.mydomain:pop3s it works perfect. [image: Inline image 1] Also i check from https://www.sslshopper.com/ssl-checker.html web page i can see all correct ceritificate paths but i try to this command openssl s_client -connect mail.mydomain:pop3s -starttls imap it says CONNECTED and hang. second command is correct? also my thunderbird client doesnt work with 143 port and STARTTLS. is this general issue or have we config error? thanks in advance Selçuk YAZAR

2 1

Make fails with 2.3.0 on Mac OS X 10.7.5
by James Brown 10 Jan '18

10 Jan '18

Compile is failing for me. ./configure --with-mysql --with-ssl=openssl: ... checking for SSL_read in -lssl... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking openssl/err.h usability... yes checking openssl/err.h presence... yes checking for openssl/err.h... yes checking if OpenSSL version is 1.0.1 or newer... true checking if OpenSSL version is 1.0.2 or better... true checking whether SSL_clear_options exists... no ... No problems. But then ‘make’ ends with: dcrypt-openssl.c:117: error: field 'ctx' has incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ctx_hmac_destroy': dcrypt-openssl.c:451: warning: implicit declaration of function 'HMAC_cleanup' dcrypt-openssl.c: In function 'dcrypt_openssl_generate_ec_key': dcrypt-openssl.c:555: error: dereferencing pointer to incomplete type dcrypt-openssl.c:556: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_local': dcrypt-openssl.c:588: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_peer': dcrypt-openssl.c:668: error: dereferencing pointer to incomplete type dcrypt-openssl.c:697: error: dereferencing pointer to incomplete type dcrypt-openssl.c:698: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_private_key_dovecot': dcrypt-openssl.c:1461: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1482: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1489: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_load_private_key': dcrypt-openssl.c:1615: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_public_key': dcrypt-openssl.c:1765: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_to_public_key': dcrypt-openssl.c:1801: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_name2oid': dcrypt-openssl.c:2062: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_old': dcrypt-openssl.c:2112: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_key_id_old': dcrypt-openssl.c:2135: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_evp': dcrypt-openssl.c:2153: error: dereferencing pointer to incomplete type make[3]: *** [libdcrypt_openssl_la-dcrypt-openssl.lo] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 Any suggestions? Thanks, James.

1 0

Re: openssl question
by Joseph Tam 10 Jan '18

10 Jan '18

> TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL > routines:SSL3_GET_CLIENT_HELLO:no shared cipher > > our dovecot (2.0.9 on redhat) 10-ssl.conf file we have > > ssl_cipher_list = > kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES:!SSLv3 Offhand, I don't know of a fast way to match up client cipher specs and server cipher specs. The hard part is trying to figure out what the client is doing. Maybe you can turn on dovecot "verbose_ssl = yes" and that will dump SSL diagnostics logs to point out where server/client cipher negotiations fail. You can also try and run "openssl s_server -cipher 'kEECDH:+...'" on an alternate port/host, point your client at it, and let this utility dump out the SSL cipher negotions. Joseph Tam <jtam.home(a)gmail.com>

1 0

zlib plugin producing errors on 2.3.0
by Adam Weinberger 09 Jan '18

09 Jan '18

Hello, I use the zlib and imap_zlib plugins on FreeBSD. As of 2.3.0, my logs are producing these errors every so often, but AFAICT the messages themselves aren't getting corrupted. Panic: file ostream-zlib.c: line 36 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0) Fatal: master: service(imap): child 80128 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) Panic: file ostream-zlib.c: line 36 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0) Fatal: master: service(imap): child 80266 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) They always come in pairs like that. Following is my doveconf. Let me know what else I can provide here. Thanks! # Adam # 2.3.0 (c8b89eb): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0 (d68c23a1) # OS: FreeBSD 11.1-RELEASE-p6 amd64 nullfs auth_mechanisms = plain login first_valid_gid = 1021 first_valid_uid = 1021 last_valid_gid = 1022 last_valid_uid = 1022 listen = imap.jail.apnoea.adamw.org mail_location = mdbox:/mail/%u/mail mail_plugins = " zlib virtual fts fts_lucene" mail_prefetch_count = 5 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox FreeBSD { autoexpunge = 17 weeks } mailbox FreeBSD/TodaysCommits { autoexpunge = 2 days } mailbox FreeBSD/automation { autoexpunge = 1 days } mailbox FreeBSD/portmgr { autoexpunge = 26 weeks } mailbox FreeBSD/ports { autoexpunge = 12 weeks } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { autoexpunge = 30 days special_use = \Trash } mailbox spam/probably { autoexpunge = 30 days } mailbox spam/totally { autoexpunge = 5 days } prefix = separator = / } passdb { args = scheme=BLF-CRYPT username_format=%u /path/to/userdb.passwd driver = passwd-file } plugin { fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 25 fts_lucene = whitespace_chars=@ sieve = file:/scripts/sieve/%u.sieve;bindir=/mail/%u/sieve/ sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +editheader sieve_filter_bin_dir = /scripts/sieve/filter sieve_pipe_bin_dir = /scripts/sieve/pipe sieve_plugins = sieve_extprograms } postmaster_address = postmaster@... protocols = imap lmtp service imap-login { inet_listener imaps { port = 0 } } service lmtp { inet_listener lmtp { port = 24 } } ssl = required ssl_cert = </path/to/fullchain.pem ssl_cipher_list = TLSv1.2+AEAD:!aNULL ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /path/to/userdb.passwd driver = passwd-file } protocol lmtp { mail_plugins = " zlib virtual fts fts_lucene sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " zlib virtual fts fts_lucene imap_zlib" } protocol lda { mail_plugins = " zlib virtual fts fts_lucene sieve" } -- Adam Weinberger adamw(a)adamw.org http://www.adamw.org

5 5

Get parts from username variable
by Matt . 09 Jan '18

09 Jan '18

Hi Guys, When I have a username like foo-bar-candy can I get/seperate foo, bar and candy as single variables for my storagepath of the usermail ? Thanks, Matt

3 2

Re: openssl question
by Joseph Tam 09 Jan '18

09 Jan '18

> but i try to this command > > openssl s_client -connect mail.mydomain:pop3s -starttls imap > > it says CONNECTED and hang. second command is correct? Uh, "pop3s" != "imap", and IMAP/STARTTLS is not the same as IMAP/SSL (or whatever the hell the terminology is nowadays). If you're testing IMAP, try one or the other or both depending of how many flavours of SSL you got going. openssl s_client -starttls imap -connect mail.mydomain:143 openssl s_client -connect mail.mydomain:993 Joseph Tam <jtam.home(a)gmail.com>

3 2

Pathetic Upgrade Question: 2.0.9 to 2.3.0
by John Tulp 09 Jan '18

09 Jan '18

My version output is below, under the heading "My actual question". Background to my woes: =================== I installed a new virtual machine with CentOS 6.9 (I'll refer to it as xxserverxx) and included the postfix server. I configured a virtual network, did a decent job of hardening firewalls for both physical host and virtual guests. I was able to get mail / mailx to send and receive mail on the command line using postfix using Maildir delivery. Sent and received email to/from self as well as from an external email address hosted elsewhere. But not being satisfied enough with mailx mail client... wanting an IMAP client on the same 192 virtual private subnet, I used yum to install dovecot package from CentOS repositories on the virtual mail guest server. Configured mail client (Evolution installled via graphical interface on a CentOS 6.9 workstation on the same subnet), and configured dovecot, used mbox delivery, struggled with documentation to understand how server mail directories/files are actually used, fixed a problem or two, but did not have IMAP send and receive working. Then, wanting to be on the latest stable version of dovecot anyway, I downloaded dovecot 2.3.0 from dovecot.org and attempted to follow the instructions on building from source, but in the end all I could really find was the simple sequence of steps, make configure, make and make install, so that's what I did. Continued struggling with configuration (needing to be somewhat certain that defaults would not create a completely wide open mail server that would be hacked in 10 minutes, since this is on a real physical host with a public ip. I actually got an email to get appended to the users mbox file. Evolution Email client at one point actually logged into dovecot/IMAP and retrieved 3 received emails. The problem is that Email client is now failing on permissions in creating index files. I've gotten to the point of going to extreme measures to "fix" that file creation problem, but to no avail. Now unfortunately I've found an underlying problem to everything, going back to the beginning where I upgraded dovecot. My actual question: ================ I don't want troubleshooting help, but help with documentation. It appears that make install has not replaced the old 2.0.9 binaries with new 2.3.0 binaries, even though it faithfully created everying under the /usr directories, e.g., /usr/bin, etc., and make install did not set some variable or otherwise configure for the new version to run instead of the old. Well, maybe. Very scary (to me) in my maillog file, starting up and shutting down doevcot... Jan 6 16:15:59 xxserverxx dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled) Jan 6 16:16:05 xxserverxx dovecot: master: Warning: Killed with signal 15 (by pid=5983 uid=0 code=kill) Jan 6 16:16:16 xxserverxx dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled) Jan 6 16:21:02 xxserverxx dovecot: master: Warning: Killed with signal 15 (by pid=6056 uid=0 code=kill) Jan 6 16:23:39 xxserverxx dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled) Precisely how should this 2.3.0, built from source, be properly installed and configured to actually run the new version ? Here is what I currently get from --version and -n, just running in my root directory: [root@xxserverxx ~]# dovecot --version 2.3.0 (c8b89eb) [root@xxserverxx ~]# dovecot -n # 2.3.0 (c8b89eb): /usr/local/etc/dovecot/dovecot.conf doveconf: Fatal: open(/usr/local/etc/dovecot/dovecot.conf) failed: No such file or directory (copy example configs from /usr/local/share/doc/dovecot/example-config/) Here is root's path: [root@xxserverxx ~]# env|grep -i path PATH=/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin Perhaps, of course, the new versions are running. Of course, it appears that the dovecot executable can't find config files. So why would my maillog say that the old version is running ? Perhaps it's the new executable running with some leftover config from the old version ? Obviously I have not a clue as to the following, and these are my questions: a) what determines from which directories are each and every dovecot executable runs (i.e., normal plus any oddball) ? b) under what userid is each one run ? c) what determines from which directories are each and every dovecot config file is read ? d) when I install a new version of dovecot, how do I control which versions of config and executables are used at runtime ? Is there a place in the documentation where all this is contained in one place in a nice organized table ? My mitigating workaround: ===================== I can of course start over, creating a brand new mail server VM, WITHOUT installing dovecot 2.0.6, and then JUST download the 2.3.0 and build and install it. At least then I will only have 1 version of dovecot present on the virtual machine to deal with. But the obvious question then remains: After my NEXT dovecot upgrade, I'm back in the quagmire, needing to know a) b) and c) above. I am confident that dovecot is not lacking in this department, I just can't find what I'm looking for in the documentation. Thanks in advance, John

4 3

Re: Pathetic Upgrade Question: 2.0.9 to 2.3.0
by Peter 09 Jan '18

09 Jan '18

On 09/01/18 11:46, John Tulp wrote: > Should I send a response to your message via an email to > dovecot(a)dovecot.org ? > Or just reply to you directly like this ? You should always reply to the mailing list unless told otherwise. > For CentOS version, I need to support 32-bit x86 a while longer. Ok. > Could you possibly save me some time and provide a > link on the dovecot.org site ? https://repo.dovecot.org/ > I really did not want to install from > source, I was very surprised that I did not find a link to download a > completely built backage on dovecot.org. The official dovecot repo is fairly new, but also GhettoForge has been providing dovecot packages for CentOS 6 and 7 for quite some time now. > Regarding yum update, yes, I would assume that I would not run yum > update after that build/install. That's a bad idea. You need to run updates on a regular basis to fix new vulnerabilities that are discovered such as the very recent meltdown and spectre vulnerabilities (look these up, they're serious). > I'm really perplexed as to why yum update would not just take me to > 2.3.0 ??? I guess the RedHat folks just include "certain" releases of > packages in the repositories ? See: https://access.redhat.com/security/updates/backporting Peter

1 0