- dovecot - dovecot.org

Doveadm field for message body without attachments
by Athanasios Viennas 11 Jan '18

11 Jan '18

Happy new year to all, what is the message field in doveadm data model representing the body without attachments? I need to dump the message body without the attachments so as to avoid unnecessary size of the exported files and while I am also not interested in this part of the message. with kind regards Athanasios

2 2

Ignored mount points forgotten on reboot
by Kenneth Porter 11 Jan '18

11 Jan '18

<https://wiki2.dovecot.org/Mountpoints> The list of ignored mount points are stored in a directory (/var/run) that's cleared on reboot. (On CentOS it's a RAM disk.) It seems this should be stored in /etc/dovecot to remain persistent across reboots. <https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard> I discovered this when I saw a dovecot error message in /var/log/maillog that some of my automounts (that don't contain mail directories) were missing. Latest dovecot from this distro is dovecot-2.2.10-8.el7.x86_64. Does the new release fix this? (I haven't seen any real problems from it, just log noise.)

1 0

Can Dovecot reject unencrypted mail?
by David Seaward 10 Jan '18

10 Jan '18

Hi, Is it possible to configure Dovecot to reject mail that is not encrypted. In other words: 1. If the user tries to send an unencrypted message from their MUA, the server rejects it. 2. If a third-party tries to send an unencrypted message to the user, the server rejects it. The end result would be that no mail stored on the server can be decrypted by the administrator. I am aware that: * "Encrypted" could mean a lot of things. I'm imagining GPG encryption, but am open to other supported methods. * This configuration would not suit everyone, e.g. someone posting to a public mailing list :) Regards, David

3 2

Re: Can Dovecot reject unencrypted mail?
by Ryan Beethe 10 Jan '18

10 Jan '18

Hi David, I don't know how to do what you want with dovecot, but what you are asking is easy and straightforward with Postfix. Postfix can easily be configured to feed mail through a milter ("mail filter") interface. You would just need to write a milter (there is a nice python library) that checks if the messages is "encrypted" to your specifications and tells Postfix to bounce the message if its not. This would be a nice backscatter-free solution. After you have the milter written, you specify it with the "smtpd_milters" option for Postfix. Ryan On Wed, Jan 10, 2018 at 02:08:38PM +0200, David Seaward wrote: > Hi, > > Is it possible to configure Dovecot to reject mail that is not > encrypted. In other words: > > 1. If the user tries to send an unencrypted message from their MUA, > the server rejects it. > > 2. If a third-party tries to send an unencrypted message to the user, > the server rejects it. > > The end result would be that no mail stored on the server can be > decrypted by the administrator. > > I am aware that: > > * "Encrypted" could mean a lot of things. I'm imagining GPG > encryption, but am open to other supported methods. > > * This configuration would not suit everyone, e.g. someone posting to > a public mailing list :) > > Regards, > David >

1 0

openssl question
by Selcuk Yazar 10 Jan '18

10 Jan '18

Hi we are using dovecot on secure port when i try to command openssl s_client -connect mail.mydomain:pop3s it works perfect. [image: Inline image 1] Also i check from https://www.sslshopper.com/ssl-checker.html web page i can see all correct ceritificate paths but i try to this command openssl s_client -connect mail.mydomain:pop3s -starttls imap it says CONNECTED and hang. second command is correct? also my thunderbird client doesnt work with 143 port and STARTTLS. is this general issue or have we config error? thanks in advance Selçuk YAZAR

2 1

Make fails with 2.3.0 on Mac OS X 10.7.5
by James Brown 10 Jan '18

10 Jan '18

Compile is failing for me. ./configure --with-mysql --with-ssl=openssl: ... checking for SSL_read in -lssl... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking openssl/err.h usability... yes checking openssl/err.h presence... yes checking for openssl/err.h... yes checking if OpenSSL version is 1.0.1 or newer... true checking if OpenSSL version is 1.0.2 or better... true checking whether SSL_clear_options exists... no ... No problems. But then ‘make’ ends with: dcrypt-openssl.c:117: error: field 'ctx' has incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ctx_hmac_destroy': dcrypt-openssl.c:451: warning: implicit declaration of function 'HMAC_cleanup' dcrypt-openssl.c: In function 'dcrypt_openssl_generate_ec_key': dcrypt-openssl.c:555: error: dereferencing pointer to incomplete type dcrypt-openssl.c:556: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_local': dcrypt-openssl.c:588: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_peer': dcrypt-openssl.c:668: error: dereferencing pointer to incomplete type dcrypt-openssl.c:697: error: dereferencing pointer to incomplete type dcrypt-openssl.c:698: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_private_key_dovecot': dcrypt-openssl.c:1461: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1482: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1489: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_load_private_key': dcrypt-openssl.c:1615: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_public_key': dcrypt-openssl.c:1765: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_to_public_key': dcrypt-openssl.c:1801: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_name2oid': dcrypt-openssl.c:2062: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_old': dcrypt-openssl.c:2112: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_key_id_old': dcrypt-openssl.c:2135: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_evp': dcrypt-openssl.c:2153: error: dereferencing pointer to incomplete type make[3]: *** [libdcrypt_openssl_la-dcrypt-openssl.lo] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 Any suggestions? Thanks, James.

1 0

Re: openssl question
by Joseph Tam 10 Jan '18

10 Jan '18

> TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL > routines:SSL3_GET_CLIENT_HELLO:no shared cipher > > our dovecot (2.0.9 on redhat) 10-ssl.conf file we have > > ssl_cipher_list = > kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES:!SSLv3 Offhand, I don't know of a fast way to match up client cipher specs and server cipher specs. The hard part is trying to figure out what the client is doing. Maybe you can turn on dovecot "verbose_ssl = yes" and that will dump SSL diagnostics logs to point out where server/client cipher negotiations fail. You can also try and run "openssl s_server -cipher 'kEECDH:+...'" on an alternate port/host, point your client at it, and let this utility dump out the SSL cipher negotions. Joseph Tam <jtam.home(a)gmail.com>

1 0

zlib plugin producing errors on 2.3.0
by Adam Weinberger 09 Jan '18

09 Jan '18

Hello, I use the zlib and imap_zlib plugins on FreeBSD. As of 2.3.0, my logs are producing these errors every so often, but AFAICT the messages themselves aren't getting corrupted. Panic: file ostream-zlib.c: line 36 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0) Fatal: master: service(imap): child 80128 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) Panic: file ostream-zlib.c: line 36 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0) Fatal: master: service(imap): child 80266 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) They always come in pairs like that. Following is my doveconf. Let me know what else I can provide here. Thanks! # Adam # 2.3.0 (c8b89eb): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0 (d68c23a1) # OS: FreeBSD 11.1-RELEASE-p6 amd64 nullfs auth_mechanisms = plain login first_valid_gid = 1021 first_valid_uid = 1021 last_valid_gid = 1022 last_valid_uid = 1022 listen = imap.jail.apnoea.adamw.org mail_location = mdbox:/mail/%u/mail mail_plugins = " zlib virtual fts fts_lucene" mail_prefetch_count = 5 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox FreeBSD { autoexpunge = 17 weeks } mailbox FreeBSD/TodaysCommits { autoexpunge = 2 days } mailbox FreeBSD/automation { autoexpunge = 1 days } mailbox FreeBSD/portmgr { autoexpunge = 26 weeks } mailbox FreeBSD/ports { autoexpunge = 12 weeks } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { autoexpunge = 30 days special_use = \Trash } mailbox spam/probably { autoexpunge = 30 days } mailbox spam/totally { autoexpunge = 5 days } prefix = separator = / } passdb { args = scheme=BLF-CRYPT username_format=%u /path/to/userdb.passwd driver = passwd-file } plugin { fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 25 fts_lucene = whitespace_chars=@ sieve = file:/scripts/sieve/%u.sieve;bindir=/mail/%u/sieve/ sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +editheader sieve_filter_bin_dir = /scripts/sieve/filter sieve_pipe_bin_dir = /scripts/sieve/pipe sieve_plugins = sieve_extprograms } postmaster_address = postmaster@... protocols = imap lmtp service imap-login { inet_listener imaps { port = 0 } } service lmtp { inet_listener lmtp { port = 24 } } ssl = required ssl_cert = </path/to/fullchain.pem ssl_cipher_list = TLSv1.2+AEAD:!aNULL ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /path/to/userdb.passwd driver = passwd-file } protocol lmtp { mail_plugins = " zlib virtual fts fts_lucene sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " zlib virtual fts fts_lucene imap_zlib" } protocol lda { mail_plugins = " zlib virtual fts fts_lucene sieve" } -- Adam Weinberger adamw(a)adamw.org http://www.adamw.org

5 5

Get parts from username variable
by Matt . 09 Jan '18

09 Jan '18

Hi Guys, When I have a username like foo-bar-candy can I get/seperate foo, bar and candy as single variables for my storagepath of the usermail ? Thanks, Matt

3 2

Re: openssl question
by Joseph Tam 09 Jan '18

09 Jan '18

> but i try to this command > > openssl s_client -connect mail.mydomain:pop3s -starttls imap > > it says CONNECTED and hang. second command is correct? Uh, "pop3s" != "imap", and IMAP/STARTTLS is not the same as IMAP/SSL (or whatever the hell the terminology is nowadays). If you're testing IMAP, try one or the other or both depending of how many flavours of SSL you got going. openssl s_client -starttls imap -connect mail.mydomain:143 openssl s_client -connect mail.mydomain:993 Joseph Tam <jtam.home(a)gmail.com>

3 2