- dovecot - dovecot.org

SSLv3 attack on pop3?
by Hans Morten Kind 31 Oct '14

31 Oct '14

We turned off SSLv3 support on our pop/imap running dovecot on Oct 16th, we did check that all users where using TLSv1 and there have been no complaints (except one old windows-phone). But at 13:00 UTC today, suddenly strange entries is seen in the logfile: Error: SSL: Stacked error: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message: SSL alert number 10 Followed by: pop3-login: Disconnected (no auth attempts in 2 secs) user=<>, rip= Some 20 ips have been seen so far, all ips are uniq and none have used our server lately. Just one resoved and it's name ends .cn, some lookups with whois leads to the same origin for all. This makes me anxious that some have made some poodle-like thing for pop3? hmk

2 2

vpopmail, open_smtp_relay and non-PLAIN auth mechs
by Jim Jagielski 31 Oct '14

31 Oct '14

I've noticed that if using the vpopmail auth setup, that the roaming-user functionality provided via open_smtp_relay() is only done if the auth mechanism is PLAIN. For example, if the client authenticates via DIGEST-MD5, the open relay file is not updated, as it should be. This is due to the call to open_smtp_relay only being done via vpopmail_verify_plain(). Instead, imo, that call should be done in auth_request_success() in the auth-request.c file, so that it is done however the authentication is done, as long as it is successful. Attached is a patch for 2.2.15. Let me know if attachments are not the preferred method and I'll cut/paste. tia! -- Jim Jagielski

2 2

Can someone explain this Sent thread sorting?
by Philip Rhoades 31 Oct '14

31 Oct '14

People, I attach a screen capture of my RoundCubeMail Sent box - why does the second item on the list, which is a separate reply to the thread above it, get sorted to position 2? By the date, and being a single mail, it should be much further down the screen . . I presume it is because the Subject is the same? Thanks, Phil. -- Philip Rhoades GPO Box 3411 Sydney NSW 2001 Australia E-mail: phil(a)pricom.com.au

2 1

Question wrt. dovecot replicator
by Remko Lodder 30 Oct '14

30 Oct '14

Hi People, I recently setup a replication service within dovecot between two machines in different datacenters, which has the following configuration; (yes it is hashed out, because I needed to) #service replicator { # unix_listener replicator-doveadm { # mode = 0666 # } # process_min_avail = 1 #} # #service aggregator { # fifo_listener replication-notify-fifo { # mode = 0666 # #user = vmail # } # unix_listener replication-notify { # mode = 0666 # #user = vmail # } #} # #service doveadm { # inet_listener { # port = 12346 # } #} # ##doveadm_port = 12346 #doveadm_password = XXXXXXX #replication_max_conns = 30 # and a mail_replica = tcp:host{a,b}:12346 configuration on each host so that they are pointing to eachother; This seems to work fine for most accounts, for example: I never experienced issues with this. However, several other accounts (with a large variety of clients) got duplicated emails. Looking with doveadm I only noticed that the numbers of the messages are closely related to eachother but one number incremented. So they cannot be deleted with the deduplicator function. The replication is provided over TCP only, the connection streams over an OpenVPN tunnel so that the contents are protected, the machines are located in different Datacenters but close to eachother. How can I determine why there are duplicated emails? What kind of messages should I specifically look for? Can I set this up for a few selected accounts instead of all accounts like it was currently? To make sure I do not make things worse for others then needs to be :-) The service had been disabled for the time being to prevent the other users from getting duplicated emails. Thanks for the advice in advance! Cheers Remko -- /"\ Best regards, | remko(a)FreeBSD.org \ / Remko Lodder | remko@EFnet X http://www.evilcoder.org/ | / \ ASCII Ribbon Campaign | Against HTML Mail and News

3 6

different mail location in different namespace
by Héctor Moreno Blanco 30 Oct '14

30 Oct '14

Hello everyone, We have Dovecot 2.1.6. With different Namespaces: ... mail_location = maildir:%h/Maildir ... namespace { separator = . prefix = inbox = yes type = private } namespace { inbox = no location = prefix = INBOX. separator = . hidden = yes type = private list = no } namespace { location = maildir:/buzon/archivo/%u/_ARCHIVO prefix = _ARCHIVO. hidden = yes separator = . type = private } We take the attribute "home directory" from the LDAP in the userdb attributes. We would like to modify this attribute for the Namespace ARCHIVO. For example, if a home directory is /buzon/buzon1/11111111, the mail location for ARCHIVO would be /buzon/archivo1/11111111. Is this modification possible without adding another attribute at the LDAP (just editing the attribute)? Thank you very much in advanced. Kind regards. Héctor Moreno. P Please consider the environment before printing this e-mail. ______________________ This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it. ______________________ Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informacion clasificada por su emisor como confidencial en el marco de su Sistema de Gestion de Seguridad de la Informacion siendo para uso exclusivo del destinatario, quedando prohibida su divulgacion copia o distribucion a terceros sin la autorizacion expresa del remitente. Si Vd. ha recibido este mensaje erroneamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboracion. ______________________

2 4

Bug in the combination of Lazy_expunge and acl plugin
by Philipp Faeustlin 30 Oct '14

30 Oct '14

Hello Timo, Hello Dovecot Developers, Hello everyone on the list, I think I have some bug, because I haven't found a working configuration till now. I use latest dovecot 2.2.13 from the dovecot-ee repository, with acl and the lazy_expunge plugin. My configuration for shared folders work fine with lazy_expunge disabled. If I enable lazy_expunge and the user (named userA), which I'm testing with, got no shared folders, then lazy_expunge is working as supposed. Now I add some shared folder for example per doveadm: doveadm acl set -u userB(a)domain.de INBOX user=userA(a)domain.de lookup read write write-seen write-deleted insert expunge create After that every list command fails with: Fatal: lazy_expunge: Unknown namespace: '.EXPUNGED/' '.EXPUNGED/' is the name for the namespace of lazy_expunge. Easiest way for me to reproduce the error is: doveadm mailbox list -u userA(a)domain.de which results in: ----------------- Trash Drafts Sent doveadm(userA(a)domian.de): Fatal: lazy_expunge: Unknown namespace: '.EXPUNGED/' ------------------ I hope someone can confirm this behavior and or give me some hints to get rid of it. Regards Philipp Fäustlin

1 0

Bug in fts (solr?, Maildir?) incorrect last_indexed_uid
by Karl O. Pinc 30 Oct '14

30 Oct '14

Hi, I thought I should document this. (Dovecot 2.2.9, see config at bottom.) I installed dovecot and then converted a number of mbox mailboxes to Maildir, and had a number of pre-existing Maildir mailboxes. I then installed the debian (wheezy) fts-solar and jetty packages, and tested my inbox using the "telnet localhost imap ... 3 SEARCH text "test" method as described on the dovecot wiki. Everything seemed to work. But when I used balsa to search a mailbox other than my inbox, I got no results. "doveadm dump" on the searched mailbox showed that "last_indexed_uid" to be the last uid of my inbox. Stopping dovecot, deleting out the dovecot-index* files, starting dovecot, and re-running "doveadm dump" showed a non-existant last_indexed_uid -- that is, last_indexed_uid did not show up in the dump output. Using the telnet method above to attempt to search again yielded no results, but this time (I think, I also tried various times with balsa) the last_indexed_uid value was that of the last uid in my trash mailbox. I don't believe I'd yet tried fts on my trash. Using balsa as an imap client the results were very consistent; every Maildir where "doveadm dump" returned no last_indexed_uid value had the last_indexed_uid set to that of the inbox's largest uid. Running "doveadm fts rescan -u foo" fixed the problem. (FWIW, now all the Maildirs seem to have a last_indexed_uid=0.) Regards, Karl <kop(a)meme.com> Free Software: "You don't pay back, you pay forward." -- Robert A. Heinlein # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-486 i686 Debian 7.7 default_vsz_limit = 1 G disable_plaintext_auth = no mail_location = maildir:~/Maildir:INBOX=~/Maildir/.inbox mail_plugins = fts fts_solr namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } namespace unconverted { hidden = no list = yes location = mbox:~/mail prefix = unconverted/ separator = / subscriptions = yes type = private } passdb { driver = pam } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/ } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl = required ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd }

1 1

Quota reporting
by Hanns Mattes 30 Oct '14

30 Oct '14

Hi, my main server will be upgraded from Dovecot 1.2something to 2.2. For testing I've installed a setup with postfix, handing malis as a relay via lmtp. So far it's up and running - really nice. AFAICS there's one issue left: Thunderbird and Kmail don't show the quota status. Using doveadm quota the information is shown correctly, even the user-specific values (coming from openldap) are set correctly. I think, I miss something obvious ... (and besides quota - any configuration hint is very welcome) linux:/etc/dovecot # doveconf -n # 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 3.7.10-1.40-desktop x86_64 openSUSE 12.3 (x86_64) auth_master_user_separator = * auth_mechanisms = plain login digest-md5 cram-md5 apop auth_verbose = yes mail_debug = yes mail_location = maildir:~/Maildir mail_plugins = " quota zlib fts fts_lucene trash" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts_autoindex = yes fts_lucene = whitespace_chars=@. quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 100M quota_rule = *:storage=1000M quota_rule2 = Trash:storage=+10%% quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_max_redirects = 32 trash = /etc/dovecot/dovecot-trash.conf.ext zlib_save = gz zlib_save_level = 6 } postmaster_address = admin(a)93er.net protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = vmail } ssl_cert = </etc/dovecot/brueckokomplett2014.crt ssl_key = </etc/dovecot/brueckofrei2014.key userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota zlib fts fts_lucene trash quota sieve" } protocol lda { mail_plugins = " quota zlib fts fts_lucene trash" } protocol imap { mail_plugins = " quota zlib fts fts_lucene trash quota imap_quota imap_zlib" } here is dovecot-ldap.conf.ext: hosts = 127.0.0.1 192.168.0.1 dn = cn=Manager,dc=dies,dc=jenes dnpass = ganzgeheim auth_bind = no base = ou=virtualmail,dc=dies,dc=jenes scope = subtree user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,quota=quota_rule=*:\ storage=%$M user_filter = (&(objectClass=CourierMailAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,homeDirectory=userdb_home,uidNumber\ =userdb_uid,gidNumber=userdb_gid,quota=userdb_quota_rule=*:storage=%M pass_filter = (&(disableimap=FALSE)(objectClass=CourierMailAccount)(uid=%u)) iterate_attrs = uid=user iterate_filter = (objectClass=CourierMailAccount) default_pass_scheme = PLAIN Any ideas? Thanks in advance regards Hanns

2 4

Renaming not supported across conflicting directory - why?
by Arkadiusz Miśkiewicz 30 Oct '14

30 Oct '14

I wonder what is point of checkign file/dir create mode like this? Here it makes problems since some folders have different permissions than others but both are accessible/writable by user. So renaming is possible (as renaming according to unix permissions). Yet dovecot artificially prevents this. /* if we're renaming under another mailbox, require its permissions to be same as ours. */ if (strchr(newname, mailbox_list_get_hierarchy_sep(newlist)) != NULL) { struct mailbox_permissions old_perm, new_perm; mailbox_list_get_permissions(oldlist, oldname, &old_perm); mailbox_list_get_permissions(newlist, newname, &new_perm); if ((new_perm.file_create_mode != old_perm.file_create_mode || new_perm.dir_create_mode != old_perm.dir_create_mode || new_perm.file_create_gid != old_perm.file_create_gid)) { mailbox_list_set_error(oldlist, MAIL_ERROR_NOTPOSSIBLE, "Renaming not supported across conflicting " "directory permissions"); return -1; } } -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

Sieve plus addressed mail filtering
by Peter Chiochetti 30 Oct '14

30 Oct '14

Today I learned, that to filter incoming plus addressed mail (user+tag@…) I had to deviate from the documentation. There it reads: if envelope :detail "to" "spam"{ fileinto "Spam"; } Instead I had to write: if address :is :detail "To" "tag"{ fileinto "Tagged"; } Dovecot version is 2.2.13-1+bigmichi1~precise+1 -- peter

2 3