- dovecot - dovecot.org

LMTP delivery honours .forward by default?
by MRob 06 Dec '16

06 Dec '16

I was under the impression that Dovecot does not look at .forward by default, since of course, Sieve is where that kind of logic should go. However, I'm seeing a .forward file being honoured by the LMTP delivery agent. Is this to be expected?

2 5

COPY vs APPEND for imapsieve?
by MRob 06 Dec '16

06 Dec '16

The examples on the imapsieve documentation page use COPY but not APPEND to watch messages coming into a folder. Are there not circumstances that a client would APPEND a message to a folder instead of COPY? Is APPEND only used by most clients for adding a sent message to the sent folder? I'm not familiar enough with IMAP clients to know if by leaving off APPEND I am safe or I am at risk to miss some actions I shouldn't.

2 2

imapsieve environment variables missing?
by MRob 06 Dec '16

06 Dec '16

RFC6785 says imap.user and imap.email environment variables should be made available but I can't access them no matter what I try. Are they not implemented because vnd.dovecot.environment already provides the username? (which does work for me) If imap.user and imap.email are there, can you provide an example how to access them so I can see what I did wrong?

2 13

Re: v2.2.27 released
by Joseph Tam 05 Dec '16

05 Dec '16

Timo announced: > https://dovecot.org/releases/2.2/dovecot-2.2.27.tar.gz > https://dovecot.org/releases/2.2/dovecot-2.2.27.tar.gz.sig > > Note that the download URLs are now https with a certificate from Let's Encrypt. wget complained about ERROR: certificate common name `wiki.dovecot.org' doesn't match requested host name `dovecot.org'. and indeed, the certificate CN and download URL is mismatched. The nice thing about Let's Encrypt is that it's easy to (re)generate the certitcate with SANs to get rid of this mismatch. Browser didn't complain though. Joseph Tam <jtam.home(a)gmail.com>

2 2

v2.2.27 released
by Timo Sirainen 05 Dec '16

05 Dec '16

https://dovecot.org/releases/2.2/dovecot-2.2.27.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.27.tar.gz.sig Note that the download URLs are now https with a certificate from Let's Encrypt. * dovecot.list.index.log rotation sizes/times were changed so that the .log file stays smaller and .log.2 is deleted sooner. + Added mail_crypt plugin that allows encryption of stored emails. See http://wiki2.dovecot.org/Plugins/MailCrypt + stats: Global stats can be sent to Carbon server by setting stats_carbon_server=ip:port + imap/pop3 proxy: If passdb returns proxy_not_trusted, don't send ID/XCLIENT + Added generic hash modifier for %variables: %{<hash algorithm>;rounds=<n>,truncate=<bits>,salt=s>:field} Hash algorithm is any of the supported ones, e.g. md5, sha1, sha256. Also "pkcs5" is supported using SHA256. For example: %{sha256:user} or %{md5;truncate=32:user}. + Added support for SHA3-256 and SHA3-512 hashes. + config: Support DNS wildcards in local_name, e.g. local_name *.example.com { .. } matches anything.example.com, but not multiple.anything.example.com. + config: Support multiple names in local_name, e.g. local_name "1.example.com 2.example.com" { .. } - Fixed crash in auth process when auth-policy was configured and authentication was aborted/failed without a username set. - director: If two users had different tags but the same hash, the users may have been redirected to the wrong tag's hosts. - Index files may have been thought incorrectly lost, causing "Missing middle file seq=.." to be logged and index rebuild. This happened more easily with IMAP hibernation enabled. - Various fixes to restoring state correctly in un-hibernation. - dovecot.index files were commonly 4 bytes per email too large. This is because 3 bytes per email were being wasted that could have been used for IMAP keywords. - Various fixes to handle dovecot.list.index corruption better. - lib-fts: Fixed assert-crash in address tokenizer with specific input. - Fixed assert-crash in HTML to text parsing with specific input (e.g. for FTS indexing or snippet generation) - doveadm sync -1: Fixed handling mailbox GUID conflicts. - sdbox, mdbox: Perform full index rebuild if corruption is detected inside lib-index, which runs index fsck. - quota: Don't skip quota checks when moving mails between different quota roots. - search: Multiple sequence sets or UID sets in search parameters weren't handled correctly. They were incorrectly merged together.

7 11

doveadm edit headers?
by MRob 05 Dec '16

05 Dec '16

Hello, is there a way to edit a message header using doveadm? I see how I can fetch the things I need, but even if I can't edit in place; if I extract the full message, edit it, there doesn't seem to be a way to append it back again?

3 5

Virtual mailboxes, please help
by Peter Hodur 05 Dec '16

05 Dec '16

Hi, I'm trying to setup virtual mailboxes. My setup: - migrated from Courier, so: separator = . prefix = INBOX. inbox = yes In doc i have read, thant i need to create separate namespace. namespace { prefix = virtual/ separator = / location = virtual:~/Maildir/virtual So i need to change / with . (Dot) in prefix and separator? Do i need to append LAYOUT=maildir++ to location? Where must location point? To the same directory where mail_location? Or do i need to create separate hierarchy for virtual mailboxes? Thanks for any answer ;) Peter ml.

3 3

Mail marked read upon download
by Curtis Vaughan 05 Dec '16

05 Dec '16

Just set up a new server with postfix and dovecot. I don't know why, but as soon as mail is accessed it is marked read. I'll see emails momentarily marked unread, but then switch to read later although I haven't opened them. This has never been an issue before. Any ideas why? Thanks. Curtis

2 1

CVE-2016-8562 in dovecot
by Aki Tuomi 05 Dec '16

05 Dec '16

We are sorry to report that we have a bug in dovecot, which merits a CVE. See details below. If you haven't configured any auth_policy_* settings you are ok. This is fixed with https://git.dovecot.net/dovecot/core/commit/c3d3faa4f72a676e183f34be960cff1… and https://git.dovecot.net/dovecot/core/commit/99abb1302ae693ccdfe0d57351fd42c… Important vulnerability in Dovecot (CVE-2016-8562) CVSS score: 7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Affected version(s): 2.2.25.1 up to 2.2.26.1 Fixed in: 2.2.27.1rc1 Short summary: Dovecot auth component can be crashed by remote user when auth-policy component is activated. If auth-policy component has been activated in Dovecot, then remote user can use SASL authentication to crash auth component. Workaround is to disable auth-policy component until fix is in place. This can be done by commenting out all auth_policy_* settings. Aki Tuomi Dovecot oy

6 12

SAML | Input buffer full (no auth attempts in 0 secs)
by mj 04 Dec '16

04 Dec '16

Hi, In my journey to enable SAML auth for our webmail (sogo.nu) I have created a password-less dovecot imap listener on 127.0.0.1/32, so that once a user is SAML authenticated for the SOGo webmail, SOGo can connect to dovecot on 127.0.0.1:143 with something like "01 LOGIN username randompassword". Watching this (tcpflow) as it happens,i can see the following auth attempt coming from sogo: > 1 login "username" "eF7VVm1vmzAQ/iuI77wY8kJQEy1t2inSukpJVU37UhlzJN7AjmyzZPv1Owfgkdjfkgkfldlkfjg9jQNMvaNZMm7RvifC/Pc/ecfaFpkcdTrUEZLoW1K3Kh4+rn2C6ViCXVXMeCFqBjw+Ll9PZDHLh+TFsPu3ERmozttTGb2PO22627DV2pVl7g+8T7dPthydZQUIcLbahgYFsPoDQmHNsYzbbms7E9nz32B8kIEuY7oxFETi8bpE6U9MAZjiiLUiABzdB1rnUJ8zqSQX+fDBwSOH54T6I49GPiu2Q4+GxPLmps9Wk1qUrTWBtP3QIUN24pShfS0qOlWXsKaF5or7ZceId++yDLMvkCzDQhPyId85l1I1VBsYLf8URcUjPHUyerj8al0BtgPOOQ2pM1lBsuvjbp9jGbBE26KykyXjlWnbkFs5bpy11hRZwAVaBa8CcCzaih1kdp7sSdmmYG1C8U9mM/2lNoLbDaDYeK55ZALVcyPOJwefde1qwFjuYrIYWzkdpgp8QC9EYKDfdybD/eDC9JQAbX08tr0huSYBDOZv3+VUD6/evQJ4HtTRo2TtR9ZGqYQopSXvGjK0yXgETDiZnoAL0InHTAm+jTMkXwDBCFUZxVeY4s9VzhWL3CSgGGpkh8A6+N22I6mWc/hk8Au8xmLZaGGiiwL9YUx1e8LgZrCbrS21yksBvbgzDssWGUOQFLe04vooDwoscmtAwGpIBBEHYzlCdAcswsGsFcPjrKsddsIBs8uK6YDGrzuEWOdBAx8ZTgi7aCdsTW4cMtLQY7FBSGuioOTZYlcRQPzy16X5FuvOYxaSbgTsOK2daNwKNL8+z4edokyJkthqoMdaW05DzQvwcLtGJvvGzy+w+" Note, the actual 'password' is even longer. This connection attempt is causing dovecot to throw the following error: > Dec 02 22:34:33 imap-login: Info: Disconnected: Input buffer full (no > auth attempts in 0 secs): user=<>, rip=x.y.z.32, lip=x.y.z.68, > session=<d+o3tLNCaOvAV48g> and > BYE Input buffer full, aborting So this doesn't work. :-( The question: is there a way to make this work? (make the input buffer larger, for example..?) Or any other ideas to make this work? Thanks in advance, MJ

2 2