- dovecot - dovecot.org

Problem switching from LDA to LMTP (with Postfix)
by Nikolaos Milas 04 Aug '17

04 Aug '17

Hello, I am trying to switch from LDA to LMTP on a Postfix/Dovecot setup, but something is going wrong. I have followed the directions at: https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP Here is a session from dovecot.log: Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(imaptester(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(nmilas(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=31, msgid=<c84ae059-854d-12bc-6aa2-9099cc2977b2(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (12) - vmail2, flags=(\Seen) What is going wrong? It seems authentication is not working correctly with this setup. If understand right, dovecot is querying ldap with the whole mail address and not with the local part only (which is the username), as I would expect. What is the suggested course of action? With LDA it was working fine; here is a sample log entry: Aug 4 12:02:51 vmail2 dovecot: lda(imaptester): sieve: msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>: stored mail into mailbox 'INBOX' Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=30, msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (11) - vmail2, flags=(\Seen) Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): Connection closed (noop finished 0.372 secs ago) in=628 out=2145 Please help me to figure out how things should be. The config file follows: ----------------------------- CONFIG START -------------------------------- protocols = imap pop3 sieve lmtp login_greeting = NOA POP/IMAP Srv XAPITI XPICTOY mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 1 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M process_limit = 500 process_min_avail = 2 } service pop3-login { service_count = 1 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </etc/pki/tls/certs/DigiCertCA.crt ssl_cert = </etc/pki/tls/certs/star_noa_gr-1243437.crt ssl_key = </etc/pki/tls/private/star_noa_gr-1243437.key ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------- CONFIG END -------------------------------- FILE: /etc/dovecot/dovecot-usrdb-ldap.conf hosts = localhost tls = no base = ou=people, dc=noa, dc=gr scope = onelevel ldap_version = 3 dn = uid=auth,ou=Sys,dc=noa,dc=gr dnpass = secret auth_bind = yes user_filter = (uid=%u) pass_filter = (uid=%u) pass_attrs = uid=user,userPassword=password auth_bind_userdn = uid=%u,ou=people,dc=noa,dc=gr user_attrs = roomNumber=quota_rule=*:bytes=%$,uid=home=/home/vmail/%u iterate_filter = (objectClass=*) ---------------------------------------------------------------------------------------- Thanks in advance, Nick

2 2

proxy-dict with tcp connection
by Ralf Becker 04 Aug '17

04 Aug '17

I try to create a patch to allow (proxy-)dict to use tcp connections instead of a unix domain socket. I'm replacing connection_init_client_unix with connection_init_client_ip: --- ./src/lib-dict/dict-client.c.orig +++ ./src/lib-dict/dict-client.c @@ -721,6 +721,10 @@ client_dict_init(struct dict *driver, const char *uri, struct ioloop *old_ioloop = current_ioloop; struct client_dict *dict; const char *p, *dest_uri, *path; + const char *const *args; + unsigned int argc; + struct ip_addr ip; + in_port_t port=0; unsigned int idle_msecs = DICT_CLIENT_DEFAULT_TIMEOUT_MSECS; unsigned int warn_slow_msecs = DICT_CLIENT_DEFAULT_WARN_SLOW_MSECS; @@ -772,7 +776,21 @@ client_dict_init(struct dict *driver, const char *uri, dict->warn_slow_msecs = warn_slow_msecs; i_array_init(&dict->cmds, 32); - if (uri[0] == ':') { + args = t_strsplit(uri, ":"); + for(argc=0; args[argc] != NULL; argc++); + + if (argc == 3) { /* host:ip:somewhere --> argc == 3 */ + if (net_addr2ip(args[0], &ip) < 0) { + *error_r = t_strdup_printf("Invalid IP: %s in URI: %s", args[0], uri); + return -1; + } + if (net_str2port(args[1], &port) < 0) { + *error_r = t_strdup_printf("Invalid port: %s in URI: %s", args[1], uri); + return -1; + } + dest_uri = strrchr(uri, ':'); + } else if (uri[0] == ':') { /* default path */ path = t_strconcat(set->base_dir, "/"DEFAULT_DICT_SERVER_SOCKET_FNAME, NULL); @@ -784,7 +802,13 @@ client_dict_init(struct dict *driver, const char *uri, path = t_strconcat(set->base_dir, "/", t_strdup_until(uri, dest_uri), NULL); } - connection_init_client_unix(dict_connections, &dict->conn.conn, path); + if (port > 0) { + connection_init_client_ip(dict_connections, &dict->conn.conn, &ip, port); + } else { + connection_init_client_unix(dict_connections, &dict->conn.conn, path); + } dict->uri = i_strdup(dest_uri + 1); dict->ioloop = io_loop_create(); But unfortunately this crashes: Jul 28 13:20:04 auth: Error: auth worker: Aborted PASSL request for info(a)outdoor-training.de: Worker process died unexpectedly Jul 28 13:20:04 auth-worker(705): Fatal: master: service(auth-worker): child 705 killed with signal 11 (core dumped) Jul 28 13:20:04 doveadm(10.44.88.1,info(a)outdoor-training.de): Error: user info(a)outdoor-training.de: Auth PASS lookup failed It looks like the tcp connection gets opened non-blocking and the first write / dict lookup happens to early: 4303041 13:44:25.120398220 0 auth (29884) < connect res=-115(EINPROGRESS) tuple=172.18.0.2:47552->10.44.99.180:2001 Looking at dict-memcached-ascii.c I probably need to do something like: i_array_init(&dict->input_states, 4); i_array_init(&dict->replies, 4); dict->ioloop = io_loop_create(); io_loop_set_current(old_ioloop); *dict_r = &dict->dict; to wait until the socket is ready ... Any idea / tips? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 2

rawlog
by Matt Bryant 04 Aug '17

04 Aug '17

Hi, Trying to get rawlog working on dovecot 2.2.31 configured as per https://wiki2.dovecot.org/Debugging/Rawlog but a) it doesnt appear to be loggin anything b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. in fact complains about unknown variable So does rawlog still do anything ???? Or am I missing something ... config is below .... # 2.2.19: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 (357ac0a0e68b+) doveconf: Warning: service auth { client_limit=30000 } is lower than required under max. load (150032) doveconf: Warning: service anvil { client_limit=22000 } is lower than required under max. load (50027) # OS: Linux 3.10.0-327.4.4.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_cache_negative_ttl = 2 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 10000 default_client_limit = 50000 default_process_limit = 50000 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_hibernate_timeout = 1 mins imap_idle_notify_interval = 1 mins login_greeting = IMAP/POP3 ready - dev-dh-ro-ms-001-b mail_attachment_dir = /var/lib/dovecot/attachments/%Ld mail_cache_min_mail_count = 5 mail_plugins = " notify replication quota virtual" mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate vacation-seconds spamtest spamtestplus editheader mbox_write_locks = fcntl mmap_disable = yes namespace { inbox = yes list = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Sent { auto = create special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } prefix = INBOX/ separator = / type = private } namespace { list = no location = virtual:/var/lib/dovecot/virtual:INDEXPVT=~/virtual prefix = virtual/ separator = / type = private } passdb { args = /etc/dovecot/sql_users.conf driver = sql } plugin { mail_log_events = delete expunge mail_log_fields = uid box msgid size mail_replica = tcp:dev-ms-001-a:4000 quota = dict:UserQuota::file:%h/dovecot-quota quota_rule2 = INBOX/Trash:storage=+10%% sieve = file:~/sieve/user;active=~/.dovecot.sieve sieve_default = file:/var/lib/dovecot/sieve/default.sieve sieve_default_name = default sieve_editheader_max_header_size = 1k sieve_extensions = +spamtest +spamtestplus +editheader +vacation-seconds sieve_global = file:/var/lib/dovecot/sieve sieve_quota_max_scripts = 5 sieve_spamtest_max_value = 200 sieve_spamtest_status_header = X-Spam-score-int: -?([[:digit:]]+) sieve_spamtest_status_type = score sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1s } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -n INBOX -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service anvil { client_limit = 22000 } service auth-worker { user = $default_internal_user } service auth { client_limit = 30000 unix_listener auth_client { mode = 0660 user = exim } } service doveadm { client_limit = 1 inet_listener { address = * port = 4000 } process_limit = 80 process_min_avail = 8 service_count = 10 } service imap-hibernate { client_limit = 8000 process_limit = 8 process_min_avail = 8 service_count = 0 unix_listener imap-hibernate { group = vmail mode = 0660 } } service imap-login { client_limit = 8000 inet_listener imap { port = 143 } process_limit = 8 process_min_avail = 8 service_count = 0 } service imap { client_limit = 1 process_limit = 50000 service_count = 100 } service managesieve-login { client_limit = 1000 inet_listener sieve { port = 4190 } process_limit = 8 process_min_avail = 8 service_count = 0 } service managesieve { process_limit = 1024 } service pop3-login { client_limit = 1000 inet_listener pop3 { port = 110 } process_limit = 8 process_min_avail = 8 service_count = 0 } service pop3 { process_limit = 10000 } service postlogin { executable = script-login -d rawlog unix_listener postlogin { group = atmail mode = 0660 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = atmail mode = 0660 } } shutdown_clients = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/sql_users.conf driver = sql } protocol imap { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual imap_quota" } protocol pop3 { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual" } protocol lmtp { auth_username_format = %Lu mail_plugins = " notify replication quota virtual sieve quota" postmaster_address = mailer-daemon }

3 3

Re: rawlog
by Joseph Tam 04 Aug '17

04 Aug '17

Matt Bryant wrote: > a) it doesnt appear to be loggin anything > b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. > in fact complains about unknown variable > ... > service postlogin { > executable = script-login -d rawlog > unix_listener postlogin { > group = atmail > mode = 0660 > } > } In my test setup, I use the first option protocol imap { ... rawlog_dir = /data/rawlogs/%u } You may also want it into your protocol pop3 section. Joseph Tam <jtam.home(a)gmail.com>

1 0

pam auth problem
by Randy Bush 03 Aug '17

03 Aug '17

# dovecot --version 2.2.31 (65cde28) on freebsd 64 10.3 system converted to dovecot 2 against my will and consuming a lot of time sorting it out. i am glad google does not charge. have spent two hours on this one alone; and undoubtedly it is my st00pidity. so excuse my desperate posting to lazynet. cram-md5 works, pam not so much Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-RELEASE-p20 amd64 auth_mechanisms = plain login cram-md5 first_valid_gid = 0 mail_location = mbox:~/mail/:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = prefix = } passdb { args = scheme=cram-md5 /usr/local/etc/dovecot.cram-md5 driver = passwd-file name = passwd-file } passdb { driver = pam } passdb { driver = pam name = pam } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 service auth { unix_listener auth-userdb { group = mail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } # cat /etc/pam.d/dovecot passdb { driver = pam args = failure_show_msg=yes args = %s }

5 10

Replication and public folders with private (seen) flags
by Ralf Becker 03 Aug '17

03 Aug '17

We started using Dovecot replication between two nodes and noticed that our configured private flags (INDEXPVT) in public/shared mailboxes are not replicated. We are only replicating INBOX namespace, as we dont want to replicate content of shared mailboxes for every user again. Is there a way to replicate the INDEXPVT or is that not (yet) implemented? Dovecot versions: # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-87-generic x86_64 Using following namespaces: namespace inboxes { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Templates { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no } namespace subs { hidden = yes list = no location = prefix = separator = / } namespace users { location = mdbox:%%h/mdbox:INDEXPVT=~/shared/%%u prefix = user/%%n/ separator = / subscriptions = no type = shared } And the following replication config: root@ka-nfs-mail:~# cat /etc/dovecot/replication.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = dovecot user = dovecot mode = 0660 } } service doveadm { inet_listener { port = 12345 #ssl = yes } } doveadm_port = 12345 doveadm_password = ******* plugin { #mail_replica = tcp:10.44.99.1 # use doveadm_port mail_replica = tcp:10.44.88.1 # use doveadm_port } replication_dsync_parameters = -d -n INBOX -l 30 -U -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

Doveadm-sync SSH practicalities
by Terry Jones 02 Aug '17

02 Aug '17

Hi, The documentation is somewhat silent on this subject. What permissions does the SSH user need ? How associated does it need to be with things like dovecot directory ownership etc ? Obviously my dovecot daemon processes are running as restricted users with "nologin" shells etc., and I don't really want to go opening them up if I don't have to. So could someone kindly please expand a little on how exactly doveadm-sync is supposed to work with SSH ? Thanks Terry

1 0

result of uid sort by subject
by TACHIBANA Masashi 02 Aug '17

02 Aug '17

Result of uid sort by subject is not expected. for example: Japanese => English => Japanese => English I'm now using Dovecot 2.2.31. command example: HNKK6 UID SORT (REVERSE SUBJECT) utf-7 ALL * SORT 3 1 7 2 4 10 11 8 12 HNKK6 OK Sort completed (0.002 + 0.041 + 0.001 secs). Any hint? -- Masashi Astro TACHIBANA QUALITIA CO., LTD. mailto:tachibana@qualitia.co.jp

2 2

Corrupt index files
by Bruce Guenter 02 Aug '17

02 Aug '17

I am running Dovecot IMAP on Linux, on a LizardFS storage cluster with Maildir storage. This has worked well for most of the accounts for several months. However in the last couple of weeks we are seeing increasing errors regarding corrupted index files. Some of the accounts affected are unable to retrieve messages due to timeouts. It appeared the problems were due to the accounts being accessed from multiple servers simultaneously, so I forced them all to access one server, but the errors remained. It looks like it has something to do with file locking, but LizardFS supports advisory file locking and I do have it enabled. Deleting the corrupted indexes fixes the problem for a while, but it eventually returns, particularly for some accounts. Here are some errors I'm seeing (just a random grab). Actual home directories are munged for confidentiality. imap[25157]: (clientes.standby) Error: Failed to fix view for HOME/clientes:standby/dovecot.index: Missing middle file seq=1 (between 1..1, we have seqs 8): File is already open imap[5565]: (stadiumchair) Error: Transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log: marked corrupted imap[5005]: (stadiumchair) Error: Corrupted transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log seq 2: indexid changed 1418941056 -> 1500658549 (sync_offset=0) imap[20243]: (martha) Error: Transaction log HOME/martha/dovecot.index.log: duplicate transaction log sequence (539) imap[4665]: (emsspam) Error: Index file HOME/emsspam/dovecot.index: indexid changed: 1500658479 -> 1297175382 imap[4665]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 3: indexid changed: 1500658479 -> 1297175382 (sync_offset=316) imap[22985]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 10742: Invalid transaction log size (9296 vs 9296): HOME/emsspam/dovecot.index.log (sync_offset=9296) imap[3267]: (emsspam) Error: Failed to map view for HOME/emsspam/dovecot.index: Failed to map file seq=10742 offset=9052..18446744073709551615 (ret=0): corrupted, indexid=0 imap[3267]: (emsspam) Error: HOME/emsspam/dovecot.index view is inconsistent: uid=3062271 inserted in the middle of mailbox The output of dovecot -n is pasted in below. Note that some of the boxes are running 4.9, some running 4.4, all have the same problems. Also note that I am using a custom authentication front end for our virtual mailboxes, but it just sets up the minimal environment variables and runs imap. Is there anything I can change to eliminate these problems? Are there any other diagnostics I can provide to shed light on this? # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # OS: Linux 4.4.66 x86_64 Gentoo Base System release 2.3 log_path = /dev/stderr mail_debug = yes mail_fsync = always mail_location = maildir:~/.maildir mail_log_prefix = "%s[%p]: (%u) " mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX separator = type = private } passdb { args = * driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

5 11

under another kind of attack
by Olaf Hopp 31 Jul '17

31 Jul '17

Hi folks, "somehow" similar to the thread "under some kind oof attack" started by "MJ": I have dovecot shielded by fail2ban which works fine. But since a few days I see many many IPs per day knocking on my doors with wron password and/or users. But the rate at which they are knocking is very very low. So fail2ban will never catch them. For example one IP: Jul 25 14:03:17 irams1 dovecot: auth-worker(2212): pam(eurodisc,101.231.247.210,<gAulHSNVsNZl5/fS>): unknown user Jul 25 15:16:36 irams1 dovecot: auth-worker(11047): pam(gergei,101.231.247.210,<dPzYIyRVtOpl5/fS>): pam_authenticate() failed: Authentication failure (password mismatch?) Jul 25 16:08:51 irams1 dovecot: auth-worker(3379): pam(icpe,101.231.247.210,<Ws6t3iRVkOhl5/fS>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Note the timestamps. If I look the other way round (tries to one account) I'll get Jul 25 01:30:48 irams1 dovecot: auth-worker(11276): pam(endsulei,60.166.12.117,<slp6mhhViI48pgx1>): unknown user Jul 25 01:31:26 irams1 dovecot: auth-worker(11276): pam(endsulei,222.243.211.200,<s0+6nBhVabHe89PI>): unknown user Jul 25 13:29:22 irams1 dovecot: auth-worker(4745): pam(endsulei,60.2.50.114,<4elhpCJVtcw8AjJy>): unknown user Jul 25 13:30:27 irams1 dovecot: auth-worker(4747): pam(endsulei,222.84.118.83,<kaE1qCJVn7neVHZT>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Jul 25 16:11:45 irams1 dovecot: auth-worker(5933): pam(endsulei,206.214.0.120,<R5H56CRVdJfO1gB4>): unknown user Also note the timestamps! And I see many many distinct IPs per day (a few hundred) trying many many existing and non-existings accounts. As you see in the timestamps in my examples, this can not be handled by fail2ban without affecting regular users with typos. Is anybody observing something similar ? Anybody an idea against this ? Many of these observed IPs are chinese mobile IPs, if this matters. But we have also chinese students and researchers all abroad. Regards, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

11 16