- dovecot - dovecot.org

Crashing when run against OpenSSL 1.1.0c
by Michael Marley 15 Nov '16

15 Nov '16

Hi, I am running Dovecot 2.2.26.0 compiled against OpenSSL 1.1 and, since upgrading to OpenSSL 1.1.0c, the "lmtp" process has been crashing with SIGSEGV whenever it receives SIGINT. This always happens a minute or so after the lmtp process handles a message. It can also be manually reproduced by sending SIGINT to one of the running lmtp processes. I am compiling and running on an Ubuntu 17.04 x86_64 system using GCC 6.2. Here is the output of me reproducing it with gdb: (gdb) signal SIGINT Continuing with signal SIGINT. Program received signal SIGSEGV, Segmentation fault. 0x00007f6748cc2fb0 in ?? () (gdb) bt #0 0x00007f6748cc2fb0 in ?? () #1 0x00007f674872ac60 in ossl_init_thread_stop (locals=<optimized out>) at crypto/init.c:336 #2 0x00007f674872aee4 in OPENSSL_cleanup () at crypto/init.c:391 #3 0x00007f67491052e0 in __run_exit_handlers (status=0, listp=0x7f674948c5d8 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:83 #4 0x00007f674910533a in __GI_exit (status=<optimized out>) at exit.c:105 #5 0x00007f67490eb3f8 in __libc_start_main (main=0x555b35fbfbc0 <main>, argc=1, argv=0x7ffd4ede3588, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd4ede3578) at ../csu/libc-start.c:325 #6 0x0000555b35fbfe3a in _start () Here is the output of "doveconf -n": # 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (623ae77) # OS: Linux 4.8.7-040807-generic x86_64 Ubuntu Zesty Zapus (development branch) auth_mechanisms = plain login auth_username_format = %Ln mail_location = mdbox:~/mdbox mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = michael(a)michaelmarley.com protocols = imap sieve lmtp service auth { client_limit = 1624 unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 0 } } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt ssl_cert = </etc/ssl/private/michaelmarley.com.crt ssl_cipher_list = HIGH !RC4 !aNULL !eNULL !3DES @STRENGTH ssl_dh_parameters_length = 4096 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } local_name matthewtmarley.com { ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt ssl_cert = </etc/ssl/private/matthewtmarley.com.crt ssl_key = # hidden, use -P to show it } I tried recompiling Dovecot to see if that might do any good, but I got the same result. Also, I noticed that the "test-crypto" test in src/lib-dcrypt also crashes on exit (despite the fact that all the tests succeeded) with a very similar stacktrace: (gdb) run Starting program: /home/michael/Source/dovecot/core/src/lib-dcrypt/test-crypto [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". test_cipher_test_vectors ............................................. : ok test_cipher_aead_test_vectors ........................................ : ok test_hmac_test_vectors ............................................... : ok test_load_v1_keys .................................................... : ok test_load_v1_key ..................................................... : ok test_load_v1_public_key .............................................. : ok test_load_v2_key ..................................................... : ok test_load_v2_public_key .............................................. : ok test_get_info_v2_key ................................................. : ok test_gen_and_get_info_rsa_pem ........................................ : ok test_get_info_rsa_private_key ........................................ : ok test_get_info_invalid_keys ........................................... : ok test_get_info_key_encrypted .......................................... : ok test_get_info_pw_encrypted ........................................... : ok test_password_change ................................................. : ok test_load_invalid_keys ............................................... : ok 0 / 16 tests failed Program received signal SIGSEGV, Segmentation fault. 0x00007ffff75a5480 in ?? () (gdb) bt #0 0x00007ffff75a5480 in ?? () #1 0x00007ffff6ff7c60 in ossl_init_thread_stop (locals=<optimized out>) at crypto/init.c:336 #2 0x00007ffff6ff7ee4 in OPENSSL_cleanup () at crypto/init.c:391 #3 0x00007ffff78472e0 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007ffff784733a in exit () from /lib/x86_64-linux-gnu/libc.so.6 #5 0x00007ffff782d3f8 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6 #6 0x000055555555f68a in _start () If there is anything I have missed or if there is any other way I can help, please let me know. Thanks, Michael Marley

3 3

lazy-load SNI?
by Felipe Gasper 15 Nov '16

15 Nov '16

Hello, We’re rolling out large SNI deployments for our mail servers. Each domain gets an entry like this in the config: local_name mail.foo.com { ssl_cert = </ssl/domain_tls/*.foo.com/combined ssl_key = </ssl/domain_tls/*.foo.com/combined } There are a couple problems we’re finding with this approach: 1) Dovecot wants to load everything at once, which has some machines taking up many GiB of memory just for Dovecot. Is there any way to defer loading of an SSL cert until a client actually requests it? 2) Any time we add or remove a domain, Dovecot’s SNI config matrix needs to be rebuilt. Is there a way to handle SNI requests dynamically via some sort of configuration plugin, so we wouldn’t need to rebuild the config on domain add/remove? I looked through the docs but couldn’t see a way to do this. Thank you in advance! -Felipe Gasper Mississauga, ON

4 12

[PATCH] ssl: fix reference to SSLv2 and disable SSLv3
by Apollon Oikonomopoulos 15 Nov '16

15 Nov '16

This is driven by the fact that OpenSSL 1.1 does not know about SSLv2 at all and dovecot's defaults simply make OpenSSL error out with "Unknown protocol 'SSLv2'"[1]. So we change the defaults to refer to SSLv2 iff OpenSSL seems to know something about it. While at it, it's also a good idea to disable SSLv3 by default as well. [1] https://bugs.debian.org/844347 Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- doc/example-config/conf.d/10-ssl.conf | 2 +- src/lib-master/master-service-ssl-settings.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/example-config/conf.d/10-ssl.conf b/doc/example-config/conf.d/10-ssl.conf index 31b750c..2cd445b 100644 --- a/doc/example-config/conf.d/10-ssl.conf +++ b/doc/example-config/conf.d/10-ssl.conf @@ -46,7 +46,7 @@ ssl_key = </etc/ssl/private/dovecot.pem #ssl_dh_parameters_length = 1024 # SSL protocols to use -#ssl_protocols = !SSLv2 +#ssl_protocols = !SSLv3 # SSL ciphers to use #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL diff --git a/src/lib-master/master-service-ssl-settings.c b/src/lib-master/master-service-ssl-settings.c index 4a05045..6b43f6c 100644 --- a/src/lib-master/master-service-ssl-settings.c +++ b/src/lib-master/master-service-ssl-settings.c @@ -44,7 +44,11 @@ static const struct master_service_ssl_settings master_service_ssl_default_setti .ssl_key = "", .ssl_key_password = "", .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL", - .ssl_protocols = "!SSLv2", +#ifdef SSL_TXT_SSLV2 + .ssl_protocols = "!SSLv2 !SSLv3", +#else + .ssl_protocols = "!SSLv3", +#endif .ssl_cert_username_field = "commonName", .ssl_crypto_device = "", .ssl_verify_client_cert = FALSE, -- 2.10.1

2 1

save failed to open mailbox quarantine
by Eggert Ehmke FTV Spandau 15 Nov '16

15 Nov '16

I have dovecot 2.2.13 set up with spamassassin and amavis. This works fine so far, Spam emails are forwarded to "username+Quarantine(a)mydomain.de". The recipient_delimiter=+ is set, the Quarantine folder exists. However, Dovecot tries to deliver it to a folder quarantine, that does not exist. In the dovecot-deliver.log there are these lines: Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@wookie>: save failed to open mailbox quarantine: Mailbox doesn't exist: quarantine Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@xxxxxx>: saved mail to INBOX Indeed the message is found in the inbox. What can be done so the folder name is not converted to lower case?

2 5

How does one mark all messages as read (imap4flag "seen") with sieve?
by Ben Johnson 15 Nov '16

15 Nov '16

Hello! I had hoped that marking all messages that arrive to a specific mailbox as read/seen would be as simple as applying the following sieve script to all incoming mail for that mailbox user: ######################## require ["imap4flags"]; addflag "\\Seen"; ######################## With this script in-place, mail does not appear to be marked as read/seen. It arrives as it normally would, and my email client sees it as new mail. Is something more required? Or is it a bug/limitation in my email client? I've found many examples of "addflag "\\Seen";" on the web, but all of them are wrapped in conditional logic of some variety. This is a spam-training mailbox and I simply want everything marked as seen/read upon arrival so I'm not bothered/notified every time. Thanks for any pointers here! -Ben

3 12

dovecot / tcp-wrappers / FBSD 10.3
by Jim Pazarena 14 Nov '16

14 Nov '16

Can anyone share the proper config to get wrappers working in dovecot on FreeBSD? The dovecot examples do not seem to work, and I thought perhaps FBSD needs slightly different configs. I've compiled with: -DHAVE_LIBWRAP which I presume is the first step. The example for dovecot.conf in uncommenting: login_access_sockets = tcpwrap merely causes a log error of "imap-login: Error: connect(tcpwrap) failed: No such file or directory" Suggestions/Direction much appreciated.

3 2

Self-Signed Certificate issue
by Darryl Baker 13 Nov '16

13 Nov '16

My apologies if this is a repeat but my search of the archive did not turn it up in the recent past. If this has been covered just point me at the previous thread, please. I am running a small email site which I am moving from uw-imapd and Solaris to Ubuntu and Dovecot imaps and pop3s. I am trying to use a self-signed certificate for this site. I am using Thunderbird as the test client. I've tried both the pre-built snakeoil certificate and building a special one for dovecot. In /var/log/mail.err I keep getting what I am interpreting as a missing CA cert. The message is: dovecot: imap-login: Error: SSL: Stacked error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 The certificate was created by: openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.pem The Dovecot version is 2.2.22 (fe789d2) The Ubuntu version is 16.04 LTS current patches. *Darryl Baker*

3 3

help needed configuration of quota warning mails
by Götz Reinicke 13 Nov '16

13 Nov '16

Hi, we run dovecot 2.2.24 and from what I see, quota management with warning message is configured currently with "noenforcing". Our individual quota limit is stored in the users ldap DN which is fetched as I see from the logs and by "doveadm quota get -u" I tried to trigger the warning mail by going over the limit on my account step by step and can see that values are counted with the command above and in thunderbird by showing the orange and than red warning symbol at the bottom for me. But the warning mail script is not triggert. How may I debug this? /usr/local/bin/quota-warning.sh is owned currently by vmail and executable by vmail. Thanks for feedback and suggestion . /Götz

1 0

Dovecot lmtp
by Peter Fraser 13 Nov '16

13 Nov '16

Hi All I am migrating from dovecot-1.x where I had LDA running to dovecot2-2.2.26.0_1 where I am trying to set up LMTP. I have enabled a TCP/IP socket .Setting below. service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } and put this additional entry in postfix virtual_transport = lmtp:127.0.0.1:24 in 10-mail.conf my mail location is below mail_location=maildir:~/Maildir:INBOX=~/Maildir/:INDEX=~/Maildir/tmp/index My problem is that when I enable lmtp, dovecot creates a new maildir at /home/vmail/user(a)domain.com and delivers the email there in a Maildir instead of using the default one at /home/vmail/username I researched it but I just can't seem to figure out why this is. I would really appreciate any help on this. Thanks in advance.

2 1

Redirect the emails from domain2 to domain1
by Quaquaraquà 11 Nov '16

11 Nov '16

Dear Dovecot and Exim users, I have a VPS using these two applications. I am transitioning from a domain_old to a domain_new. I'd like to redirect all the emails from domain_old to the local mailboxes of users @ domain_new. In exim I've assumed that it is enough to add domain_old to the list of local domains: domainlist local_domains = @ : domain_new : domain_old ... begin routers ... local_users: debug_print = "R: local_user for $local_part@$domain" driver = accept domains = +local_domains transport = dovecot_lmtp cannot_route_message = Unknown user However in Dovecot I'm checking both the username and the domain to perform the authentication: auth_username_format = %Lu passdb { driver = sql ; } password_query = SELECT username, domain, password FROM users WHERE username = '%n' AND domain = '%d' To have this system to work, I wish some special rule that rewrites the domain from domain_old to domain_new. But I'm not sure whether this needs to be done in exim or dovecot and how to add it? - Quaquaraqua'

3 2