- dovecot - dovecot.org

Re: Password encription
by Joseph Tam 29 Oct '17

29 Oct '17

Aki Tuomi wrote: > The use of salt, today, is to prevent the attacker from directly seeing > who has same passwords. Of course it also will make a rainbow table > attack less useful, Not just less useful, but almost infeasible. Given the use of random salts, you would have to generate (number of possible salts) rainbow tables. This drastically changes the CPU/storage tradeoffs. > but then again, no one uses rainbow tables anymore > since it takes about few minutes to brute force a password in the cloud > or on your home computer GPU. SHA512-CRYPT uses by default 4000 rounds > on dovecot, to make it more computationally expensive, but still it's > not very strong protection anymore. I know it is theoretically possible, but really, how feasible is it? The way people talk about it, they make it sound trivial. As a test, I just generated a hash using "doveadm pw". Any takers? {SHA512-CRYPT}$6$qyQANQFbQGqOSqHh$Z4YVIe.QakXtWs63lWUmzlseKpiFzfPCKhwM0NQk8jP6QeRmk6POkCdSrFBmVO2wh.dgPCPA7Gq3sNUeKOZLM/ > MD5 with or without salt can be ATTAcked at passwords per second speed, > so using CRAM-MD5 of DIGEST-MD5 is very very poor choice. Anything with > MD5 should not be used for passwords these days. > > With Dovecot 2.3 we are making BLF-CRYPT available on all platforms, and > also adding support for ARGON2 when you have libsodium available. Straight hashes, without question, are weak. I routinely break NTLM hashes with rainbow tables. I'm *not* arguing against the use of stronger hashes, I'm just skeptical of the FUD surrounding the user of older salted hashes. This is especially true if the hashes are guarded against leakage, as most are. Strong crypt-hashes are an extra layer of protection (defense in depth). This page (if you trust 3rd parties) will report whether a password was ever found in a breached databases. You can also download the SHA1 hashes of all their known cracked passwords. It's big -- 5.3Gb 7-zipped file. https://haveibeenpwned.com/Passwords "j.emerlik" further asks: > You mean that today they using encrypted passwords to seeing > who has same passwords using brute force, hashes dictionary attack ? They precompute hashes for large number of password candidates, then look up hashes in that table. Rainbow tables are a way of folding large tables into a smaller ones, trading off space for extra CPU time. However, for hashes that use non-trivial salts, you would need to precompute an astronomically large number of tables. An attacker might be better off with a straight CPU-bound brute force search. Joseph Tam <jtam.home(a)gmail.com>

3 3

Need help in understanding auth digest-md5 and realm
by Admin Beckspaced 28 Oct '17

28 Oct '17

Hello dovecot community, I've setup dovecot and need a bit help in understanding the auth mechanism digest-md5 and realm in 10-auth.conf I got auth_mechanisms = plain login digest-md5 cram-md5 apop #auth_realms = #auth_default_realm = So i got empty realms. Auth normally works fine and clients can auth with mechanism digest-md5 and I see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,46.85.229.153,<klUjO3FcTy8uVeWZ>): Generating DIGEST-MD5 from user 'user(a)temizbau.de', password 'xxxx' dovecot: auth: Debug: sql(user(a)gruene-wiesentheid.de,87.168.26.5,<ISVLQXFcT/xXqBoF>): Generating DIGEST-MD5 from user 'user@gruene-wiesentheid.de@', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)vitaler-genuss.de,81.209.203.170,<tzxyT3FcT9RR0cuq>): Generating DIGEST-MD5 from user 'user(a)vitaler-genuss.de', password 'xxxxxxxxxxx' But sometimes clients get a password mismatch and I the see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,80.187.103.15,<adzhAnVclmxQu2cP>): Generating DIGEST-MD5 from user 'user@temizbau.de@mail.beckspaced.com', password 'xxxx' dovecot: auth: Debug: sql(user(a)thansadet.com,87.218.86.165,<LWItYHVc6r1X2lal>): Generating DIGEST-MD5 from user 'user@thansadet.com@mail.beckspaced.com', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)plaa-thansadetresort.com,110.164.127.146,<aGhcvHBcStJupH+S>): Generating DIGEST-MD5 from user 'user@plaa-thansadetresort.com@imap.beckspaced.com', password 'xxxxxxxxxx' when there's a password mismatch I see a different user string for generating the digest-md5 hash. i suppose users use a different mail client and the mail client does things differently? How can I fix this password mismatch thing? Do i just need to set an auth_realms of some random string in the 10-auth.conifig Or does the auth_realms need to be a host name? Domain name of some sort? For the moment I just removed the digest-md5 mechanism ... Or could I just simply not offer that mechanism? If someone could shed some light on this I would be more than grateful ;) Thanks & greetings Becki

4 6

Quota warning executable can not log to /dev/stdout
by Michael Härtl 28 Oct '17

28 Oct '17

I'm running dovecot 2.2.27 in a alpine based docker container and want to log to /dev/stdout. I therefore added this setting: log_path = /dev/stdout Logging works fine so far. Now I've added a quota-warning script. With the log_path setting above the script creates warnings like: Oct 28 10:27:01 quota-warning: Error: Can't open log file /dev/stdout: No such device or address Oct 28 10:27:01 quota-warning: Fatal: master: service(quota-warning): child 460 returned error 75 When I change log_path to something like /tmp/dovecot.log everything works fine. Dovecot itself is started via s6 with a run script like this: #!/bin/sh exec /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf What could cause this issue and how could I fix it? For the record here's my doveconf -n output: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # OS: Linux 4.4.27-x86_64-jb1 x86_64 ext4 auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 100 log_path = /dev/stdout mail_gid = dovecot mail_home = /var/mail/domains/%d/%n mail_location = maildir:/var/mail/domains/%d/%n mail_max_userip_connections = 160 mail_plugins = " quota" mail_privileged_group = dovecot mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for user %u exceeded (Benutzer %u hat sein Speichervolumen ueberschritten) quota_grace = 10%% quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 80 %u %d } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 10001 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh group = dovecot unix_listener quota-warning { mode = 0666 user = dovecot } user = vmail } ssl_cert = </certs/fullchain.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } protocol imap { mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

2 2

How to check which version of openssl is getting compiled in into dovecot?
by krzf83＠gmail.com 27 Oct '17

27 Oct '17

I got multiple versions of openssl in my system. I compile dovecot with PKG_CONFIG_PATH=/usr/openssl-1.0.2l-fpic/lib/pkgconfig ./configure How do I check which version of openssl got compiled in? configure script does not show version. There seem to be no way to check it in compiled binary (?) My dovecot is still seen vulnerable by tls testing tools so I'm guessing wrong version of openssl got compiled it but there seem to be no way to check it.

3 7

secure setup for imap hibernation
by Arkadiusz Miśkiewicz 27 Oct '17

27 Oct '17

Hi. What's the approach for securely enabling imap hibernation in case when each user uses different uid and gid? Looks like none and 0666 on hibernation and imap master sockets is the only way? Thanks, -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 3

Re: Password encription
by Aki Tuomi 27 Oct '17

27 Oct '17

SHA512-CRYPT and PLAIN/LOGIN with SSL. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 12:07 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password encription What scheme and mechanism do you recommend? 2017-10-25 11:01 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > CRAM-MD5 should not be used. Its not terribly secure. > > > ---Aki TuomiDovecot oy > -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:58 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password > encription > Thx Aki, > with CRAP-MD5 as scheme and mechanism it's works corretlly. > > 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > > > PLAIN and LOGIN. > > > > > > > > --- > > Aki Tuomi > > Dovecot oy > > > > -------- Original message -------- > > From: "j.emerlik" <j.emerlik(a)gmail.com> > > Date: 25/10/2017 11:41 (GMT+02:00) > > To: Dovecot Mailing List <dovecot(a)dovecot.org> > > Subject: Password encription > > > > Hi, > > which authentication mechanism should I use for SHA-256 password schama ? > > Regards, > > Jack > > >

3 6

Looking for NTLM config example
by Mark Foley 26 Oct '17

26 Oct '17

Now that I am running Thunderbird on Linux and away from Windows/Outlook, I'd like to take another run at setting up NTLM authentication from Thunderbird to my Samba4 AC/DC. With the help of the samba maillist folks I was able to set up NTLM authentication for domain user login. I should be able to do the same for email! But, I need help. I went to http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and got lost immediately. Are "authenticaion submethods" synonymous with "password schemes"? The 7th line down says, "NTLM password scheme is required for NTLM, NTLM2 and NTLMv2.", but in the referenced link I found no reference to "NTLM password scheme". The links http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and http://wiki2.dovecot.org/Authentication/PasswordSchemes, tell you what the 4 NTLM authentication submethods are, tells you what password schemes are, tells you what the NTLM client/server handshake is, but doesn't actually tell you how to configure dovecot config files. I'm much more interested in the "how to" than in: "NTLMv2: server and client nonce, MITM can't force downgrade" ... whatever that means. Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML and any other supporting settings or configs I need? My current/working dovecot settings, which have been running perfectly for well over a year now, are: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { driver = passwd } verbose_ssl = yes Here's what I've tried so far as 10-auth.conf: disable_plaintext_auth = no auth_use_winbind = yes info_log_path = /var/log/dovecot_info auth_verbose = yes auth_debug_passwords = yes auth_verbose_passwords= plain auth_winbind_helper_path = /usr/bin/ntlm_auth auth_mechanisms = ntlm plain login userdb { driver = passwd args = username_format=%n allow_all_users=yes } Which gives me a dovecot -n of: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = ntlm plain login auth_use_winbind = yes auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { args = username_format=%n allow_all_users=yes driver = passwd } verbose_ssl = yes I configured Thunderbird for NTLM authentication, then tried sending a message, I got the following in /var/log/dovecot_info: Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Apr 22 01:37:57 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.58, lip=98.102.63.107, session=<xFuyOgwx9wDAqAA6> On Thunderbird I got the error, "Sending of the message failed. The Outlgoing server (SMTP) my.server.name does not support the selected authentication method. Please change the 'Autnentication method' in 'Account Settings | Outgoing Server (SMTP)'." Clearly, something is configured wrong, but I've no clue what. Can I get some advice? THX --Mark

8 19

Initialization failed: Namespace '': mkdir(/var/www/mail) failed: Permission denied
by trash＠skrilnetz.net 26 Oct '17

26 Oct '17

Hi, I'm running dovecot (v 2.2.9) on ubuntu 14.04 since a long time. I did not change any configuration lately and I'm getting the below error message. /dovecot: lda(www-data): Error: user www-data: Initialization failed: Namespace '': MKDIR(/VAR/WWW/MAIL) failed: Permission denied (euid=33(www-data) egid=33(www-data) missing +w perm: /var/www, dir owned by 1001:1001 mode=0755//) / I did some troubleshooting and I don't understand where the MKDIR(/VAR/WWW/MAIL) is coming from. Mailboxes are in /var/mail and sending/receiving emails is working as it always did. mail_location is still setup to be MAIL_LOCATION = MBOX:~/MAIL:INBOX=/VAR/MAIL/%U Why is it trying a mkdir in /var/www? Any help would be appreciated. Rgs,

3 11

haproxy ssl support
by Rok Potočnik 26 Oct '17

26 Oct '17

Even though it seems dovecot (using 2.2.33.1) supports haproxy's send-proxy-v2, it seems to lack send-proxy-v2-ssl (which also sends client's ssl state). It would be a nice feature for the backend server to identify clients so one wouldn't have to use disable_plaintext_auth on a production environment. --- haproxy.cfg frontend pop3 bind [::]:110 v4v6 bind [::]:995 v4v6 ssl crt /etc/pki/tls/private/haproxy.pem mode tcp default_backend pop3 backend pop3 mode tcp balance leastconn stick store-request src stick-table type ip size 200k expire 30m timeout connect 5000 timeout server 50000 server proxy1 [2001:db8::11]:10110 send-proxy-v2-ssl server proxy2 [2001:db8::22]:10110 send-proxy-v2-ssl --- --- dovecot.conf haproxy_trusted_networks = [2001:db8::]/64 service pop3-login { inet_listener pop3_haproxy { port = 10110 haproxy = yes } } --- It would also be nice if haproxy would support STARTTLS offloading but that's a subject for a different mailing list ;) -- BR, Rok

3 3

fts-solr: fresh start or reindex large mailboxes
by Anton Borovoy 26 Oct '17

26 Oct '17

Hi, Install solr (in the end 7.1.0) there were errors: Caused by: org.eclipse.jetty.io.EofException: Early EOF and from dovecot: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: backend I could not find for a long time what the problem was and set the nginx as a proxy, and see that dovecot breaks the connect after 60 seconds. After examining the code, I found the fixed connection time: http_set.request_timeout_msecs = 60 * 1000; which is clearly not enough for large data. After searching, he also found this post https://dovecot.org/pipermail/dovecot-cvs/2015-March/025551.html 1. I think it would be a good idea to remove these settings in the configuration file dovecot.conf A bit of statistics from nginx, solr and nginx on same server (req_len == post body): 60 seconds, requests do not pass: [25 / Oct / 2017: 23: 07: 11 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947631.364 req_time 86.863 req_len 171401961 499 [25 / Oct / 2017: 23: 07: 25 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947645.149 req_time 74.657 req_len 70140598 499 [25 / Oct / 2017: 23: 11: 28 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508947888.834 req_time 90.776 req_len 205474676 499 600 seconds, requests do not pass: [26 / Oct / 2017: 04: 50: 50 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508968250.522 req_time 811.480 req_len 3083215798 499 [26 / Oct / 2017: 04: 51: 06 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508968266.432 req_time 666.089 req_len 556157906 499 [26 / Oct / 2017: 05: 06: 18 +0700] POST / solr / dovecot / update HTTP / 1.1 resp_time - msec 1508969178.612 req_time 797.983 req_len 3083215798 499 2. the index is more than 3g is transmitted painfully, can U make a queue limit on the size of the request, segment them, adjust max size of post body in the configuration file dovecot.conf thx solr: 7.1.0 dovecot: 2.2.32 server: Intel(R) Xeon(TM) CPU 2.93GHz x24, 72G RAM

1 0