- dovecot - dovecot.org

failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

Hello to everyone, On Debian Jessie (no SElinux) and "dovecot-sieve 1:2.2.13-12~deb8u1" I've changed the sieve (sieve_after) Junk and Trash path, from: "INBOX.Junk" to "INBOX/Junk" compiled it: sievec /etc/dovecot/sieve-after/spam-to-folder.sieve but now if i look into mail.err log, found this: Jul 24 07:22:01 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: msgid=<887291195.6699.1500873334921.JavaMail.trend@backend-prod-003>: failed to store into mailbox 'INBOX/Junk': Permission denied Jul 24 07:22:02 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: execution of script /etc/dovecot/sieve-after/spam-to-folder.sieve failed, but implicit keep was successful and many others.. This is the "spam-to-folder.sieve content": require ["fileinto","mailbox"]; if header :contains "X-Spam-Flag" "YES" { fileinto :create "INBOX/Junk"; stop; } where I'm wrong? many thanks!

1 0

dovecot/pigeonhole and sogo
by Thomas Robers 24 Jul '17

24 Jul '17

Hello, I have two systems one with dovecot 2.2.31/Pigeonhole 0.4.19 selfcompiled through the src.rpms from ghettoforge on a CentOS 6.9 server and a second system of SOGo (3.2.9, nightly) on CentOS 7. Everything worked together until I made the update to Dovecot 2.2.31 Pigeonhole 0.4.19. Since then I get an error message when I try to upload a sieve-script. SOGo shows a message popup that "the service is temporarily not available" and in the log file of Dovecot i get: > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<25U/xB5U/KLCw8GK> > Jul 12 15:26:41 mail2 dovecot: auth: Debug: auth client connected (pid=12182) > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<4zxBxB5U/qLCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12263) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<uiR64B5UDKPCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12264) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=1192.168.1.135, TLS: Disconnected, session=<LeJ74B5UDqPCw8GK> Does this mean that managesieve-login doesn't get authentication data from SOGo? SOGo logs for this error: > S[0x7f368f2bab60]: "IMPLEMENTATION" "Dovecot Pigeonhole" > S[0x7f368f2bab60]: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" > S[0x7f368f2bab60]: "NOTIFY" "mailto" > S[0x7f368f2bab60]: "SASL" "PLAIN" > S[0x7f368f2bab60]: "VERSION" "1.0" > S[0x7f368f2bab60]: OK "Dovecot ready." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD > > S[0x7f368f2bab60]: NO "Error in MANAGESIEVE command received by server." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD Than I compiled Dovecot 2.2.31 together with Pigeonhole 0.4.18 and than everything works again as expected. I can upload and activate sieve-scripts from the SOGo webinterface. After that I tried to disable TLS for sieve with ssl = no in the 20-managesieve.conf: [...] protocol sieve { ssl = no [...] to capture the traffic between SOGo and Dovecot/Pigeonhole but then the managesieve-login process crashes: > Jul 12 16:28:32 mail2 dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 12941 killed with signal 11 (core dumps disabled) [last ip=192.168.1.138] Why isn't it possible to disable TLS for sieve and what changes between Pigeonhole 0.4.19 and 0.4.18 could be responsible for the disharmony between SOGo and Pigeonhole. I looked for 'changes' but could not find any hints regarding this problem. Is there a chance to get both work together again? And is it possible to disable TLS for sieve or why crashes the managesieve-login daemon? Any help would be welcome. TIA Thomas Robers

2 2

Modify stored mail contents?
by Evan Martin 23 Jul '17

23 Jul '17

Is there a safe way to modify the contents of emails stored by Dovecot? I'll probably only want to change the message bodies, not the headers, if that matters. Looking for ways to do this both for existing emails and new emails as they are received (though anything that works for existing emails can probably just be run again for new emails.) My mail storage is currently mdbox, but I could migrate to another format if that helps.

5 8

10-ssl ssl = no but dovecot still reads certs
by lists＠lazygranch.com 22 Jul '17

22 Jul '17

I'm bringing up a new email server starting without TLS initially. In 10-ssl.conf I set ssl = no, but the default ssl_cert and ssl_key lines are not commented out. I got the obvious error message: ------------------------------ doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 12: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot -------------------------- No big deal, but I don't remember this being an issue the last time I set up a server. You would think if ssl=no, the ssl_cert and ssl_key files would not be opened.

3 2

Re: under some kind of attack
by Joseph Tam 22 Jul '17

22 Jul '17

mj <lists(a)merit.unu.edu> wrote: > - for external users, to ONLY be allowed to use an application specific > password. (or username and password, fine as well) > > Step one: making ldap password authentication valid only from our > internal network. I though: using allow_nets=192.168.1.0/24 for that passdb > > But I can't get that to work. :-( Unsure where exactly to define the > allow_nets, tried many variations on the theme already. > > Perhaps someone can help with the step one, and also tell me if the > approach outlined above is smart, valid and do-able in dovecot. As per my post: checkpassword. You can then use one password on Mondays, Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday fetched from a rot-13 database, and only from prime numbered IP addresses on weekends, if that's what you want. Gary Sellani <lists(a)lazygranch.com> writes: > Not applicable to most installations, but I use geographical filtering > on all ports other than 25. Fine if you are the only user of the email > system. If you're the only user, moving the IMAP/POP service to a nonstandard port will do most of that with much less bother, and you won't lock yourself out, requiring a ssh/edit firewall/reconnect. Been there, done that. > I get one hacker a week trying to guess passwords, and always from Digital Ocean VPS. abuse(a)digitalocean.com is fairly responsive. They usually nuke them pretty quickly. > I would like to see statistics on the success of such brute force > attacks. They can't be very successful these days. Even if the success rate is 0.00001%, you can do the arithmetic to see that's still a huge number of accounts. But you're right, if you have anything resembling a sensible password policy, they're just a log bloating nuisance. Joseph Tam <jtam.home(a)gmail.com>

2 1

FTS error Unknown user
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, sorry for previous message, i accidentaly send it before it was complete. Recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error everytime a email is received (and FTS is not working, of course): dovecot: indexer-worker: Error: User [censored] lookup failed: Unknown user I don't fully understand why FTS needs to do any user lookup during indexing but, anyway, how can i workaround it? This is relevant config: passdb { driver = static args = password=[censored] allow_nets=[censored] } userdb { driver = static args = home=/var/mail/vhosts/%d/%n/home master_user=%u } plugin { fts = solr fts_solr = url=http://[censored]:8080/solr/ fts_autoindex = yes fts_autoindex_max_recent_msgs = 1000 } FTS is fully configured and working on proxy side (which is, currently, also a backend for most of the users - i will split it in stages, just wanted to say that i have FTS already working). azur

1 1

FTS
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error after every email is received:

1 0

Problem compiling dovecot 2.2.31 on Solaris
by Luciano Mannucci 21 Jul '17

21 Jul '17

I'm trying to compile under SunOS 5.8 Generic_117350-28 sun4u sparc SUNW,Ultra-5_10 (I know it's a bit oldish :-) and I get this error: /bin/bash ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c -o pkcs5.lo pkcs5.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c pkcs5.c -fPIC -DPIC -o .libs/pkcs5.o pkcs5.c:9:20: error: stdint.h: No such file or directory make[4]: *** [pkcs5.lo] Error 1 What have I missed? I did: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var\ --mandir=/usr/share/man --docdir=/usr/share/doc/packages/dovecot\ --disable-ipv6 --enable-header-install\ make Is it reasonable? Thanks in advance, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 6

under some kind of attack
by mj 21 Jul '17

21 Jul '17

Hi all, It seems we are under some kind of password guessing attack: > Jul 18 21:33:33 auth: Info: ldap(username1,103.6.223.61,<W7wLl5xUfABnBt89>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:34:16 auth: Info: ldap(username1,221.4.61.180,<89WnmZxUrADdBD20>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:36:13 auth: Info: ldap(username2,117.243.180.225,<ESWBoJxUdQB187Th>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:50 auth: Info: ldap(username2,58.59.103.230,<j7fQopxUNgA6O2fm>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:56 auth: Info: ldap(username4,58.215.13.154,<gtY5o5xUlQA61w2a>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:18 auth: Info: ldap(username3,220.175.154.205,<lFxppJxUFADcr5rN>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:25 auth: Info: ldap(username5,14.142.29.142,<40zopJxUSgAOjh2O>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:27 auth: Info: ldap(username4,119.1.98.121,<JDQOpZxUCwB3AWJ5>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:54 auth: Info: ldap(username3,218.76.156.11,<OMqtppxUMADaTJwL>): invalid credentials (given password: 1q2w3e4r) Different IPs, different usernames, but all (almost) the same password. Any idea what we can do about this?? Any advice you could give us would be very much appreciated. MJ

7 18

application specific passwords
by mj 21 Jul '17

21 Jul '17

Hi, Further to the other thread about password guessing activities against our dovecot, I would like to implement application specific passwords on our dovecot. Googling results in some documents, but they are all a bit older: > https://www.happyassassin.net/2014/08/26/adding-application-specific-passwo… > https://www.dgsiegel.net/news/2013_05_21-application_specific_passwords_for… > http://www.justinbuchanan.com/blog/category/RoundCube > http://www.justinbuchanan.com/blog/post/2012/12/02/Application-Specific-Pas… Those articles are interesting, but also rather old. (I realse that this does not neccesarily mean: irrelevant or bad) Is there anone here with some additional notes, ideas, tips, trics on setting up application specific passwords with dovecot with virtual users? We are using samba AD as an authentication backend. MJ

3 5