- dovecot - dovecot.org

dict host param and fqdn
by Stéphane Cottin 15 Nov '17

15 Nov '17

Hi, I would like to use a fqdn instead of an IP address as redis host quota_clone_dict = redis:host=redis.host.name:port=6379 But only ip adresses are supported Error: quota_clone_dict: Failed to initialize 'redis:host=redis.host.name:port=6379': dict redis: Invalid IP: redis.host.name Why is name resolution not implemented here ? Is it for performance considerations ? Stéphane

1 0

Building dovecot 2.2.33.2 is broken with uclibc-ng
by Bernd Kuhls 14 Nov '17

14 Nov '17

Hi, this commit https://github.com/dovecot/core/commit/c9d76e2baf653fa5504d6849e5c1aae32eff… added code which can not be compiled with uclibc-ng 1.0.26 using buildroot: make[3]: Entering directory '/home/bernd/buildroot/br4/output/build/dovecot-2.2.33.2/src/lib-test' /bin/bash ../../libtool --tag=CC --mode=compile /home/bernd/buildroot/br4/output/host/bin/i586-buildroot-linux-uclibc-gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-charset -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -std=gnu99 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include -c -o test-common.lo test-common.c libtool: compile: /home/bernd/buildroot/br4/output/host/bin/i586-buildroot-linux-uclibc-gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-charset -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -std=gnu99 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include -c test-common.c -fPIC -DPIC -o .libs/test-common.o In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:34:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:32:24: error: expected identifier or '(' before '__extension__' static inline uint16_t bswap_16(uint16_t in); ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:92:24: error: redefinition of '__bswap_64' static inline uint64_t bswap_64(uint64_t in) ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:75:1: note: previous definition of '__bswap_64' was here __bswap_64 (__uint64_t __bsx) ^~~~~~~~~~ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:104:24: error: redefinition of '__bswap_32' static inline uint32_t bswap_32(uint32_t in) ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:44:1: note: previous definition of '__bswap_32' was here __bswap_32 (unsigned int __bsx) ^~~~~~~~~~ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:34:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:112:24: error: expected identifier or '(' before '__extension__' static inline uint16_t bswap_16(uint16_t in) ^ Makefile:491: recipe for target 'test-common.lo' failed To reproduce try something like this: $ git clone git://git.buildroot.net/buildroot $ cd buildroot $ echo "BR2_PACKAGE_DOVECOT=y" > dovecot.defconfig $ make defconfig BR2_DEFCONFIG=dovecot.defconfig Patch buildroot: diff --git a/package/dovecot/dovecot.hash b/package/dovecot/dovecot.hash index 184745b394..3dbc50739c 100644 --- a/package/dovecot/dovecot.hash +++ b/package/dovecot/dovecot.hash @@ -1,2 +1,2 @@ # Locally computed after checking signature -sha256 034be40907748128d65088a4f59789b2f99ae7b33a88974eae0b6a68ece376a1 dovecot-2.2.31.tar.gz +sha256 fe1e3b78609a56ee22fc209077e4b75348fa1bbd54c46f52bde2472a4c4cee84 dovecot-2.2.33.2.tar.gz diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index 4cc6ae4de7..25a78b9f78 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -5,7 +5,7 @@ ################################################################################ DOVECOT_VERSION_MAJOR = 2.2 -DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).31 +DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).33.2 DOVECOT_SITE = http://www.dovecot.org/releases/$(DOVECOT_VERSION_MAJOR) DOVECOT_INSTALL_STAGING = YES DOVECOT_LICENSE = LGPL-2.1 Start the build using "make dovecot" and get some coffee/tee ;) Regards, Bernd

2 3

Doubt about replacing alt storage disks
by Amol Kulkarni 14 Nov '17

14 Nov '17

Hello, I have a working setup of dovecot 2.2.19 on centos 6. The mailbox format is mdbox. I've configured primary and alt storage. Now I want to replace the disk of the alt storage only. Broadly my plan to change it is as follows : 1. Mount the new disk on a temporary server. 2. Rsync data only from alt storage to the new disk - while the original server is live. This may take a few days. In between altmove will happen on the live disk. 3. Once the basic rsync is complete, stop all services on the live server 4. Mount the new disk on live server, in addition to live disk 5. Do final rsync - with the delete option 6. Unmount the live disk and mount new disk in its place 7. Start services I've 2 doubts abt this plan : 1. I've tried the first part until step 2. After the first rsync, I found unexpected differences between the m.* files on the live and new disk. The new disk has some additional files for some users, which are not present on the live disk. Since the rsync was run without delete option, these files were not deleted from the new disk. Does altmove delete some m.* files to reorganize mail ? Can end user mail deletion cause deletion of m.* files ? 2. I'm worried about commonly occuring problems with such movement : duplicate mail download in pop / resync in imap / index corruption. Is there any way to check integrity of data before switching to the new disk ? Thanks in advance, Amol.

1 0

Re: IMAP connections with ".eml" in the username - bot attack.
by Joseph Tam 14 Nov '17

14 Nov '17

James Brown writes: > We are seeing lots of IMAP login attempts like this: > > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xcentrex5fxnewx5fxyorkx5fxquotex5fxisx5fxreadyx2dxx2dx426453.eml>, method=PLAIN, rip=197.255.60.118, > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xmatchingx5fxyourx5fxrecentx5fxvisitx5fxonx5fxx2dxx2dx121584.eml(a)bordo.com.au>, method=PLAIN, rip=37.235.28.229, > > etc. > Is anyone else experiencing this? How is such an attack is supposed to > ever succeed? What are they trying to accomplish? Haven't seen it. I agree with another poster -- probably a spammer screwed up their spamware configuration. > Any ideas on how to mitigate it? Mitigate what? Even by your account, this won't get them anywhere, unless it's so fast and heavy, it's DoS'ing your system. Other than that, they're just bloating your logs, nothing more. If you want to pre-empt this via firewall, you'll need to get extremely lucky to characterise these IPs (a sample of 2 is not enough) in such a way as to able to formulate a firewall rule. Mostly likely, this is a rented botnet. If you somehow figure out an oracular rule to discern bot from some user road-warrior *before* they connect, give me a call. Sean Greenslade <sean(a)seangreenslade.com> writes: > Here's a fun laugh I found in one of my webserver logs: > >> 1446098745 218.249.219.2 "GET http://www.sciencedirect.com/science/book/9780123525512" 400 425 "" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)" > > Not my website, nothing even close to that url is hosted on that server. Common proxy target. They're testing whether your web server will support anonymous web proxying. Almost exclusively from China. Joseph Tam <jtam.home(a)gmail.com>

1 0

SMTP and IMAP authentication critically fails out of the blue
by Felix Plapper 14 Nov '17

14 Nov '17

Hello Community and first things First: dovecot --version2.2.9dovecot -n# 2.2.9: /etc/dovecot/dovecot.conf# OS: Linux 3.13.0-042stab125.5 x86_64 Ubuntu 14.04.5 LTSauth_mechanisms = plain logindict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf}listen = *,[::]log_timestamp = "%Y-%m-%d %H:%M:%S "login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %kmail_fsync = alwaysmail_home = /var/vmail/%d/%nmail_location = maildir:~/mail_nfs_index = yesmail_nfs_storage = yesmail_plugins = quota aclmanagesieve_notify_capability = mailtomanagesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihavemmap_disable = yesnamespace { list = yes location = maildir:%%h/:INDEXPVT=~/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared}namespace inbox { inbox = yes location = mailbox Archiv { special_use = \Archive } mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { special_use = \Archive } mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Entwürfe { special_use = \Drafts } mailbox "Gelöschte Objekte" { special_use = \Trash } mailbox Gesendet { special_use = \Sent } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Papierkorb { special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = /}passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/vmail/shared-mailboxes.db quota = dict:User quota::proxy::sqlquota quota_rule2 = Trash:storage=+100%% sieve = /var/vmail/sieve/%u.sieve sieve_after = /var/vmail/sieve/global.sieve sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_quota_max_storage = 0}protocols = imap sieve lmtp pop3service auth { unix_listener /var/spool/postfix/private/auth_dovecot { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } unix_listener auth-userdb { mode = 0600 user = vmail } user = root}service dict { unix_listener dict { group = vmail mode = 0660 user = vmail }}service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail}service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 2 service_count = 1 vsz_limit = 128 M}service managesieve { process_limit = 256}ssl_cert = </etc/ssl/mail/mail.crtssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHAssl_dh_parameters_length = 2048ssl_key = </etc/ssl/mail/mail.keyssl_protocols = !SSLv3 !SSLv2userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}protocol imap { mail_plugins = quota imap_quota imap_acl acl}protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota sieve acl postmaster_address = postmaster(a)domain1.com}protocol sieve { managesieve_logout_format = bytes=%i/%o}remote 127.0.0.1 { disable_plaintext_auth = no}########################################### Mail.errNov 13 23:59:06 webdev dovecot: auth: Error: PLAIN(account(a)domain2.com, XXX.XXX.XXX.XXX,<y869CoDETEST4dHk>): Request 29154.1 timed out after 150 secs, state=1########################################### Mail.logNov 13 23:27:54 webdev dovecot: auth: Error: LOGIN(account(a)domain1.com,IP.IP.IP.IP,<oN4ly+TestDZ6dHk>): Request 28118.1 timed out after 150 secs, state=1Nov 13 23:27:57 webdev dovecot: auth: Error: PLAIN( account(a)domain2.com,XXX.XXX.XXX.XXX,<FAxKe+JaatES7tHk>): Request 28120.1 timed out after 150 secs, state=1Nov 13 23:28:24 webdev dovecot: imap-login: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 180 secs): user=<>, method=LOGIN, rip=ClientIP, lip=ServerIP, TLS: Disconnected, TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits) [...]Nov 13 23:47:15 webdev dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=84.119.151.17, lip=62.75.185.32########################################### I did not change anything on my client nor serverside setup and i suddenly could not reach the Mailserver anymore. Obviously I can reach the Server using SSH or HTTP. I hope I provided all infos you need to help me in this situation. And am grateful for every hint to solve this Note: Older mailinglist threads did not help because a link which solved a similar case is not available anymore.plus I tried to make the given pieces of information structured using styles. Maybe it gets delivered,displayed and enhances the ease of reading.

2 1

Carbon_name path hardcoded
by Giordano Fechio (Giu) 13 Nov '17

13 Nov '17

Hello, I am setting up the imap_stats for dovecot and stumb up on a problem with carbon_name setup. const char *prefix = t_strdup_printf("dovecot.%s.global”, But I need to setup the path myself so my index cam be compliant to the index I already have. Wonder if changing it to something like the following so other users have a way to configure their own path or use the default in case they don’t want to worry about that. string_t *str = t_str_new(256); - const char *prefix = t_strdup_printf("dovecot.%s.global", + if ( strstr(carbon_name , "." != NULL) { + const char *prefix = t_strdup_printf("", stats_settings->carbon_name); + } else { + const char *prefix = t_strdup_printf("dovecot.%s.global", + stats_settings->carbon_name); + } If that is not the goal or if I am not using it right , let me know. Bests, G Fechio

1 0

ACL on shared folder
by T.Robers＠smtp.tutech.de 13 Nov '17

13 Nov '17

Hello everybody, we're using shared mailboxes as an archive to which everyone has full rights, set with doveadm. The rights look like this: doveadm acl get -u bob(a)example.com shared/archive(a)example.com ID Global Rights user=bob(a)example.com admin create delete expunge insert lookup \ post read write write-deleted write-seen Looking at this i would this i would think i should be able to move an existing folder to shared/archive(a)example.com. But i get a "permission denied". A rawlog session from trying to copy looks like this: 1 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE NOTIFY ACL RIGHTS=texk] Logged in * ID ("name" "Dovecot") 2 OK ID completed (0.001 + 0.000 secs). * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1510573115] UIDs valid * OK [UIDNEXT 1] Predicted next UID 3 OK [READ-WRITE] Select completed (0.005 + 0.000 + 0.004 secs). * MYRIGHTS shared/archive(a)example.com/IT-Sachen/blablub lrwstipekxacd 4 OK Myrights completed (0.001 + 0.000 secs). + idling * OK Still here 5 OK Idle completed (4.007 + 4.006 + 4.006 secs). 6 OK NOOP completed (0.001 + 0.000 secs). + idling 7 OK Idle completed (42.014 + 42.013 + 42.013 secs). 8 OK List completed (0.015 + 0.000 + 0.014 secs). 9 OK Close completed (0.001 + 0.000 secs). 10 NO [NOPERM] Permission denied (0.005 + 0.000 + 0.004 secs). I don't understand why there's a permission denied because doveadm tells something else. The shared mailbox folder ist the inbox of the account archive(a)example.com What has to be changed that it's possible to save messages or to create folders in resp. under a shared inbox, or is this not possible? Any suggestion is welcome. Tia Thomas My configuration: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 2.6.32-696.13.2.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12345 imap_max_line_length = 2 M mail_debug = yes mail_location = maildir:/export/home/imap/%Lu/Maildir mail_plugins = acl mail_log notify mailbox_idle_check_interval = 10 secs mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/export/home/shared-db/shared-mailboxes mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change mail_log_fields = uid box msgid size from flags mail_replica = tcp:mail2.example.com sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ sieve_user_log = ~/.dovecot.sieve.log } protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 20 } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog } service replicator { unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail2.example.com.crt_chain ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 !SSLv2 syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl mail_log notify sieve } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl mail_log notify imap_acl rawlog_dir = /tmp/rawlog/%u }

1 0

rawlog segfaults (error 4 in libdovecot.so.0.0.0)
by T. Robers 13 Nov '17

13 Nov '17

Hello everybody, i tried to debug imap sessions with the rawlog feature and rawlog creates files but when i try to dump them doveadm tells me [...] Error: zlib.read((file)): unexpected EOF at [...]. I looked at syslog files and i see, that rawlog gets terminated with a segfault, e.g.: segfault at 10 ip 00007ff6da362596 sp 00007fffe725a080 error 4 in libdovecot.so.0.0.0[7ff6da2a4000+122000] Is there a way to debug why rawlog ist terminated? I haven't found anything.I would be very thankful, if somebody could give a hint. My system is: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 2.6.32-696.3.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no imap_max_line_length = 2 M mail_debug = yes mail_location = maildir:/export/home/imap/%Lu/Maildir mail_plugins = acl zlib mail_log notify mailbox_idle_check_interval = 10 secs mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/export/home/shared-db/shared-mailboxes mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change mail_log_fields = uid box msgid size from flags sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ sieve_user_log = ~/.dovecot.sieve.log zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 20 } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog -f in } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail.tutech.de.crt_chain ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 !SSLv2 syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl zlib mail_log notify imap_zlib imap_acl rawlog_dir = /tmp/rawlog/%u } Tia Thomas

4 3

imap coredump after doveadm altmove
by Frank Koch 13 Nov '17

13 Nov '17

Hello, i tried to move mails to an alt storage with the following command: doveadm altmove -u user(a)domain.de mailbox Inbox After that, the imap process produces a core dump (files has not been moved): Maillog: dovecot: imap-login: Login: user=<user(a)domain.de>, method=PLAIN, rip=X.X.X.X, lip=X.X.X.X, mpid=5393, TLS, session=<83JiHqNdTwCsEAIf> dovecot: imap(user(a)domain.de): Fatal: master: service(imap): child 5393 killed with signal 11 (core dumped) Version: Dovecot 2.2.18.2 OS: CenotOS6 2.6.32-696.10.2.el6.x86_64 local storage (ext4) #gdb --args /usr/libexec/dovecot/imap -u user(a)domain.de A1 STATUS INBOX (MESSAGES) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff74b3c9a in __strrchr_sse2 () from /lib64/libc.so.6 (gdb) bt full #0 0x00007ffff74b3c9a in __strrchr_sse2 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ffff7b148cd in sdbox_file_move () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #2 0x00007ffff7b18284 in sdbox_sync_begin () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #3 0x00007ffff7b18382 in sdbox_sync () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #4 0x00007ffff7b18437 in sdbox_storage_sync_init () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #5 0x00007ffff7af64b3 in mailbox_sync_init () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #6 0x00007ffff7af7d27 in mailbox_sync () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #7 0x00007ffff7b62af2 in index_storage_get_status () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #8 0x00007ffff67eb32c in ?? () from /usr/lib64/dovecot/lib10_quota_plugin.so No symbol table info available. #9 0x00007ffff6c021e4 in ?? () from /usr/lib64/dovecot/lib01_acl_plugin.so No symbol table info available. #10 0x00007ffff7af8931 in mailbox_get_status () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x000000000041e07a in imap_status_get () No symbol table info available. #12 0x0000000000413629 in cmd_status () No symbol table info available. #13 0x00000000004178ed in command_exec () No symbol table info available. #14 0x00000000004168d0 in ?? () No symbol table info available. #15 0x0000000000416966 in ?? () No symbol table info available. #16 0x0000000000416c5d in client_handle_input () No symbol table info available. #17 0x0000000000416fdf in client_input () No symbol table info available. #18 0x00007ffff7852fbb in io_loop_call_io () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #19 0x00007ffff785418f in io_loop_handler_run_internal () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #20 0x00007ffff7853049 in io_loop_handler_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #21 0x00007ffff78530c8 in io_loop_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #22 0x00007ffff77f2043 in master_service_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #23 0x00000000004206c1 in main () No symbol table info available. This is only on folders i have tried to move. best regards, Frank Koch --

1 0

IMAP connections with ".eml" in the username - bot attack.
by James Brown 13 Nov '17

13 Nov '17

We are seeing lots of IMAP login attempts like this: dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xcentrex5fxnewx5fxyorkx5fxquotex5fxisx5fxreadyx2dxx2dx426453.eml>, method=PLAIN, rip=197.255.60.118, or dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xmatchingx5fxyourx5fxrecentx5fxvisitx5fxonx5fxx2dxx2dx121584.eml(a)bordo.com.au>, method=PLAIN, rip=37.235.28.229, etc. We are running fail2ban, but as each login attempt is from a different IP it is not able to stop them. We are running Sophos UTM firewall but that has no IMAP Proxy and never will. Is anyone else experiencing this? How is such an attack is supposed to ever succeed? What are they trying to accomplish? Any ideas on how to mitigate it? Thanks, James.

3 3