- dovecot - dovecot.org

Re: under another kind of attack
by Davide Marchi 30 Jul '17

30 Jul '17

Hi to all, @Olaf Hopp I've this filter enabled for fail2ban, my question is: could my filters overlap or interfere with those suggested by you? this is my filter: Contents of /etc/fail2ban/jail.conf: [postfix] # Ban for 10 minutes if it fails 6 times within 10 minutes enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log maxretry = 6 bantime = 600 findtime = 600 Contents of /etc/fail2ban/filter.d/postfix.conf: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision$ [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # # Jul 11 02:35:08 mail postfix/smtpd[16299]: lost connection after AUTH from unknown[196.12.178.73] failregex = lost connection after AUTH from unknown\[<HOST>\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = Many thanks!

2 1

Re: under another kind of attack
by Joseph Tam 28 Jul '17

28 Jul '17

(I think I am testing other readers' patience, so if you want to follow-up, you can Email me directly.) > but how often do you have to type your username ? Not often, but I'm not talking the typical case. The larger the population you serve, the more circumstances you'll have to cover. > Only on the initial config of your mailer. After that you are done. Mail reader setups by users is often an error prone process, judging from the number of times I have to correct a setup. This is especially true for an educational institution that typically has a large turnover of accounts. If a user gets it initially wrong, then fixes their mistake, they can't get it to work despite trying all sorts of config variations, not realizing it can't be resolved anymore. Result: trouble call. If someone blows it setting on a multi-user workstation, other users with a working setups can't log in. Result: trouble call. If a student flubs their credentials, all the roommates behind their residential NAT gateway suffer. Result: trouble call. If a user screws up using an external service that slurps their mail (e.g. Gmail, Yahoo, uniboxapp, etc.), or worse, someone malicious does it on puropse, all other users of this service will be DoS'd. Result: trouble call(s). If a user acquires a DHCP address in a polluted network ..., well you get the idea. Not to mention ex-users who forget to remove their mail accounts from their smartphones, leaving a trail of blacklist entries in their wake as they travel from coffee shops to other public WiFi hotspots. > So this is why I decided to use two distinct jails with > different policies. It seems to work reasonable well. Until it doesn't. If it works for you, more power to you. The cost/benefit of a hair-trigger blacklist policy is that it saves you a few log entries showing futile attempts at finding weak passwords (because you have strong passwords, don't you?) at the risk of dealing with any of the above situations. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 27 Jul '17

27 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> wrote: > And I have a new one just for "unknown user" and here my bantime and findtime > are much bigger and the retries are just '2'. So here I'm much harsher. > I'll keep an eye on my logs and maybe some more twaeking is necessary. Just be careful about typos (like twaeking!): users could simply misspell their username, or get mixed up with some another account or alias. This is why I favour targetting known bad accounts, not merely accounts that don't exist. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission
by Davide Marchi 26 Jul '17

26 Jul '17

> From: Thomas Leuxner <tlx(a)leuxner.net> >> cat /etc/dovecot/dovecot-acl >> * user=booking(a)hotelsangiorgioriccione.com lrwsi >> * user=info(a)hotelsangiorgioriccione.com lrwsi > Hi Davide, > > For LMTP to file the mails you need to add the p flag (POST). Well, I've added the "p" flag and now I will monitor the situation ;-) PS Just as an additional note, just after making this change and reload Dovecot I have detected (oneshot) this error message: Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF But now everything seems to work well (let's hope) ;-) Many thanks Thomas!

1 0

Return extra fields from passwd userdb
by Michele Petrella 26 Jul '17

26 Jul '17

Hi all. I use dovecot 2.2.29.1. Output of dovecot -n: # 2.2.29.1 (e0b76e3): /var/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) # OS: Linux 3.10.55-gentoo i686 SuSE Linux 7.1 (i386) debug_log_path = /var/log/dovecot/dovecot_debug.log disable_plaintext_auth = no info_log_path = /var/log/state.mail/dovecot.pipe log_path = /var/log/dovecot/dovecot.log mail_debug = yes mail_gid = users mail_location = maildir:~/.maildir mail_plugins = acl quota mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/data/home/vmail/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:/data/home/%%n/.maildir:INDEX=~/.maildir/shared/%%u prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Cestino { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox "Posta inviata" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot-dict/shared-mailboxes quota = maildir:User quota quota_rule = *:storage=5M quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore sieve = ~/.dovecot.sieve sieve_before = /var/etc/dovecot/sieve/general/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/dovecot/sieve-execute sieve_filter_bin_dir = /usr/local/bin/dovecot/sieve-filter sieve_global_dir = /var/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.filter +vnd.dovecot.pipe +editheader sieve_pipe_bin_dir = /usr/local/bin/dovecot/sieve-pipe sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = users } } service imap-postlogin { executable = script-login /usr/local/bin/imap-postlogin.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } ssl = no ssl_cert = </conf/etc/cert/certs/services/imap_pop/majornet.crt ssl_key = # hidden, use -P to show it userdb { default_fields = quota_rule=*:bytes=%$ driver = passwd } protocol lda { info_log_path = /var/log/dovecot/dovecot-lda.log log_path = /var/log/dovecot/dovecot-lda.log mail_plugins = acl quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl quota imap_acl imap_quota } I have problems in return extra fields from passwd userdb. My users are partially in passwd files and partially in LDAP. Users who use mail are in LDAP db. If I use "default_fields = quota_rule=*:bytes=100M" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=100M system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=100M doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(afasystems): Debug: Quota grace: root=User quota bytes=10485760 (10%) doveadm(afasystems): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/.maildir doveadm(afasystems): Debug: maildir++: root=/data/home/afasystems/.maildir, index=, indexpvt=, control=, inbox=/data/home/afasystems/.maildir, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 1 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/data/home/vmail/public doveadm(afasystems): Debug: maildir++: root=/data/home/vmail/public, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/data/home/%n/.maildir:INDEX=~/.maildir/shared/%u doveadm(afasystems): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(afasystems): Debug: Namespace : Using permissions from /data/home/afasystems/.maildir: mode=0700 gid=default Quota name Type Value Limit % User quota STORAGE 469 102400 0 User quota MESSAGE 6 - 0 That's ok, but i want to return quota from quotaBytes userdb parameter But if I use "default_fields = quota_rule=*:bytes=%$" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{userdb:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{ldap:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=UNSUPPORTED_VARIABLE_ldap: Invalid bytes limit: UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Error: User init failed Quota name Type Value Limit Where I am wrong? What is the correct configuration? Thanks in advance -- AFA Systems Srl Via G.Pastore Zona Industriale B 86039 Termoli (CB) - Italia tel.: +39 0875 724104 fax.: +39 0875 726084 www.afasystems.it

5 7

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

Steffen Kaiser ha scritto: > Does INBOX/Junk already exists? Yes, (but empty): find /var/vmail/hotelsangiorgioriccione.com/info/ |grep INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/dovecot.index.log /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/dovecot.index.log and same for other v-user "booking" > What's in your ACL file? cat /etc/dovecot/dovecot-acl * user=booking(a)hotelsangiorgioriccione.com lrwsi * user=info(a)hotelsangiorgioriccione.com lrwsi > What does these commands return? > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX is visible in LIST doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX/Junk' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX/Junk is visible in LIST Many thanks Steffen!

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

I add a clarification: Now that I've commented out sieve Junk/Trash on "/etc/dovecot/conf.d/15-mailboxes.conf" > mailbox Junk > { special_use = \Junk > } > mailbox Trash > { special_use = \Trash > } remains a single account with permission issues, only one with write permissions controlled by the ACL plugin: > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > sieve = ~/.dovecot.sieve > sieve_after = /etc/dovecot/sieve-after > sieve_dir = ~/sieve > } Many thanks again!

2 1

Issue on install - file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2)
by Ian Turley 26 Jul '17

26 Jul '17

First of all apologies for using such an old version - I am trying to upgrade slowly and have had to go through this version first. As you can see I am getting an error in the log file as : file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2) Raw backtrace: imap [0x80acdc1] -> imap [0x80accdc] -> imap(mbox_sync+0x14e9) [0x8079a29] -> imap(mbox_storage_sync_init+0x3e) [0x8079d8e] -> imap(imap_sync_nonselected+0x1c) [0x806183c] -> imap(_cmd_select_full+0xc3) [0x8059983] -> imap(cmd_select+0x19) [0x8059b49] -> imap [0x805afb8] -> imap [0x805b03c] -> imap(_client_input+0x6c) [0x805b71c] -> imap(io_loop_handler_run+0x110) [0x80b2a50] -> imap(io_loop_run+0x1c) [0x80b1f8c] -> imap(main+0x4c0) [0x8063640] -> /lib/libc.so.6(__libc_start_main+0xdc) [0xdd4edc] -> imap [0x80561a1] Is this some setting missing or corrupt mailbox? I only have very basic set up at this time to test. Version 1.0.7 # 1.0.7: /etc/dovecot.conf ssl_cert_file: /etc/postfix/certs/emma.turls.co.uk.crt ssl_key_file: /etc/postfix/certs/turls_csr.key login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail/:INBOX=/var/spool/mail mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Regards Ian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> writes: > I have dovecot shielded by fail2ban which works fine. But since a few > days I see many many IPs per day knocking on my doors with wron > password and/or users. But the rate at which they are knocking is very > very low. So fail2ban will never catch them. Slow roll distributed attacks. Really hard to stop. > And I see many many distinct IPs per day (a few hundred) trying many > many existing and non-existings accounts. As you see in the timestamps > in my examples, this can not be handled by fail2ban without affecting > regular users with typos. Is anybody observing something similar ? All the time, and to many services. If you need to be fault tolerant, you'll either have to set tolerant limits (allow reasonable number of failures), or timeout features. You could also track successful logins as whitelisting entries for future logins. > Anybody an idea against this ? Many of these observed IPs are chinese > mobile IPs, if this matters. But we have also chinese students and > researchers all abroad. Nearly an intractable problem, especially since your users are embedded in a notoriously infested network (as someone quipped, "like picking marshmallows out from a pile of sh*t"). Some ideas: - pre-emption (using third party RBLs that targets BFD) - immediate blacklisting of known bad users/passwords (e.g. "admin", "support", extinct users, etc.) - persistent tracking storage: tracking in SQL, or or large LRU list that can reach far enough back in time. (I think Aki mentioned weakforced which you can use instead if fail2ban to implement some of these things.) There are other solutions like alternate ports, port knocking, certificate authentication, or VPN, but they are hard/impossible to do with a large userbase, or have high setup/amortization costs. If you have a enforced strong password policy, these brute forcers have little chance of succeeding, so maybe the easiest cheapest policy is to ignore it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

"mourik jan c heupink" <lists(a)merit.unu.edu> writes: > On 07/24/2017 04:51 AM, Joseph Tam wrote:> You are essentially writing your own backend by taking over >> authentication. You'll be accepting user/password inputs into your >> checkpassword executable, then use the LDAP API (or some other system...snip >> and source address, which will be adversely affect performance on a >> busy server as authentication data cannot be cached. > > While this sounds awesome, it can do much more than what I was/am after, and appears lot more complicated to setup than what I had figured myself. > > Shouldn't I be able to do something like this: > > passdb { > driver = passwd-file > # application specific passwd-file should work from anywhere > # (so: no allow_nets) > args = /etc/dovecot/dovecot-application-specific > } > passdb { > # only allowed to use this from within local 192.168.1.0/24 > args = /etc/dovecot/dovecot-ldap.conf.ext allow_nets=192.168.1.0/24 > driver = ldap > } Yes, that would take care of *one* of the items on your wishlist (network specific passwords). You also wanted time specific passwords. And intelligent brute force detection. And blacklist lookups. Rather than cobbling together fail2ban, utility scripts, multiple passdbs, firewall rules and whatever other system you'll need to recruit, I'm suggesting you amortize the effort and pack it into one place, then you can extend this to incorporate whatever your heart desires. The complexity of implementing this reflects the complexity of your requirements. If you only had generic authentication needs, then the dovecot supplied facilities would be perfect. But you don't. > Where I would generate lines in dovecot-application-specific using a > script or some webpage, and generate lines like: > > username1:randomONE:vmail:vmail::/var/vmail/username1: > username1:randomTWO:vmail:vmail::/var/vmail/username1: > username2:randomTHREE:vmail:vmail::/var/vmail/username2: > username2:randomFOUR:vmail:vmail::/var/vmail/username2: > > And the result would be: username1 can login from anywhere, using > passwords "randomONE" & "randomTWO", plus the password in ldap when > coming from the internal network. You'll probably need 3 passdb, LDAP and 2 fallback passwd-file dbs. Joseph Tam <jtam.home(a)gmail.com>

1 0