- dovecot - dovecot.org

imap-login SSLv3 causes signal 11, core dump and DoS. ssl_protocols = ??
by James 21 Mar '15

21 Mar '15

Connecting to dovecot with ssl3 causes imap-login to die: $ openssl s_client -connect localhost:993 -ssl3 CONNECTED(00000003) 4277630796:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1461:SSL alert number 40 4277630796:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:645: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1426851034 Timeout : 7200 (sec) Verify return code: 0 (ok) --- syslog: Mar 20 11:30:35 MAILHOST dovecot: [ID 583609 mail.crit] imap-login: Fatal: master: service(imap-login): child 21918 killed with signal 11 (core dumped) [last ip=127.0.0.1] dovecot.conf had: ssl_protocols = !SSLv2 !SSLv3 removing that line stops the core dump and syslog then shows: Mar 20 11:36:25 MAILHOST dovecot: [ID 583609 mail.info] imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol, session=<eqr1ubYRWgB/AAAB> the "SSL23_GET_CLIENT_HELLO:unsupported protocol" seems to do what I thought the ssl_protocols setting did. Do I still need, if I ever needed, the "ssl_protocols = " setting? James. # dovecot -n # 2.2.16: /etc/opt/XXXX/dovecot/dovecot.conf # Pigeonhole version 0.4.7 # OS: SunOS 5.10 i86pc auth_mechanisms = plain login digest-md5 cram-md5 base_dir = /var/opt/XXXX/dovecot/ lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_trusted_networks = 111.222.333.444/24 mail_gid = vmail mail_home = /XXXXXX/XXXX/%d/%n mail_location = maildir:/XXXXX/XXXX/%d/%n/Maildir mail_max_userip_connections = 20 mail_plugins = quota mail_uid = vmail mailbox_idle_check_interval = 10 secs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate passdb { args = /etc/opt/XXXX/dovecot/dovecot-sql.conf driver = sql } plugin { fts_autoindex = yes quota = maildir:User quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+10% quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=99%% quota-warning 99 %u sieve = /XXXXX/XXXX/%d/%n/dovecot.sieve sieve_dir = /XXXXX/XXXX/%d/%n/sieve } protocols = imap lmtp sieve service auth { drop_priv_before_exec = yes unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0600 } user = root } service imap-login { chroot = drop_priv_before_exec = yes executable = imap-login -D service_count = 1 user = dovecot } service lmtp { group = vmail unix_listener lmtp { mode = 0666 } user = vmail } service quota-warning { executable = script /etc/opt/XXXX/dovecot/quota-warning user = vmail } ssl_cert = </etc/opt/XXXX/dovecot/dovecot.pem ssl_cipher_list = AES128+EECDH:AES128+EDH ssl_key = </etc/opt/XXXX/dovecot/dovecot.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /etc/opt/XXXX/dovecot/dovecot-sql.conf driver = sql } protocol lda { auth_socket_path = /var/opt/XXXX/dovecot/auth-master mail_plugins = quota sieve postmaster_address = postmaster@XXXXXXXX sendmail_path = /opt/XXXX/sbin/exim } protocol pop3 { mail_plugins = quota } protocol imap { mail_plugins = quota imap_quota } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster@XXXXXX sendmail_path = /opt/XXXX/sbin/exim }

3 9

Strange empty folders 1 1 1 1 1
by Samuel Williams 20 Mar '15

20 Mar '15

I just updated to the latest dovecot from 1.2 and it has been working great for most of my clients. But one client,who is using Outlook, has found that hundreds of folders have been created, e.g. admin@domain Deleted Items 1 admin@domain Deleted Items 1 1 admin@domain Deleted Items 1 1 1 .... admin@domain Deleted Items 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 This appears to be affecting all folders in his account, across multiple accounts for his domain. It isn't affecting any other user, even other users using outlook. All the folders are empty. Just wondering if anyone has any suggestions or ideas why this is happening. Thanks Samuel

1 0

fast sync vs. full sync
by Patrick Westenberg 20 Mar '15

20 Mar '15

Hi everyone, can anybody explain the difference between Dovecots fast sync and full sync in replication mode? Regards Patrick

2 1

indexer-worker panics with latest mercurial
by Laeeth Isharc 20 Mar '15

20 Mar '15

Hi. I am seeing the following in my logs. Happy to downgrade to an earlier version if you think this might be the problem, but dovecot.org is extremely slow (and has been for months) so I found it easier just to pull the latest from mercurial. Thanks. Laeeth Mar 12 20:48:39 indexer: Error: Indexer worker disconnected, discarding 1 reques ts for laeeth(a)laeeth.com Mar 12 20:48:39 indexer-worker(laeeth(a)laeeth.com): Fatal: master: service(indexe r-worker): child 24003 killed with signal 6 (core dumps disabled) Mar 12 20:49:01 dsync-local(laeeth(a)laeeth.com): Error: Couldn't lock /home/mail/ laeeth_laeeth_com/.dovecot-sync.lock: Timed out after 30 seconds Mar 12 20:49:16 indexer-worker(laeeth(a)laeeth.com): Error: fts_tika: PUT http://l ocalhost:9997/tika/ failed: 500 Server Error Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Warning: I/O leak: 0x7fc47d60fcf0 (line 127, fd 25) Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Panic: file ioloop .c: line 39 (io_add_file): assertion failed: (callback != NULL) Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7fc47d63fc40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7fc47d63fd1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fc47d5f02e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x87bd0) [0x7fc47d650bd0] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_move_io+0x3e) [0x7fc47d65183e] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7fc47d63db14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7fc47d614448] -> /usr/lib64/dovecot/libdovecot.so.0(+0x43876) [0x7fc47d60c876] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_post_more+0x29) [0x7fc47c733159] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x3637) [0x7fc47c72f637] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x6d83) [0x7fc47cf5dd83] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x614) [0x7fc47cf5e3c4] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc14e) [0x7fc47cf6314e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x19) [0x7fc47d8ef429] -> dovecot/indexer-worker() [0x40237c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x4c) [0x7fc47d65155c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xbb) [0x7fc47d65249b] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7fc47d6515c9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fc47d651648] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fc47d5f5703] -> dovecot/indexer-worker(main+0xcb) [0x401e7b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x32c6021d65] -> dovecot/indexer-worker() [0x401f25] Mar 12 20:49:17 indexer: Error: Indexer worker disconnected, discarding 15 reque sts for rosie(a)kaleidicassociates.com Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Fatal: master: service(indexer-worker): child 24022 killed with signal 6 (core dumps disabled) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Warning: I/O leak: 0x7f22c4d4dcf0 (line 127, fd 23) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Panic: file ioloop.c: line 829 (io_loop_move_io): assertion failed: ((old_io->condition & IO_NOTIFY) == 0) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7f22c4d7dc40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7f22c4d7dd1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f22c4d2e2e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x888ba) [0x7f22c4d8f8ba] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7f22c4d7bb14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7f22c4d52448] -> /usr/lib64/dovecot/libdovecot.so.0(+0x43876) [0x7f22c4d4a876] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_post_more+0x29) [0x7f22c3e71159] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x3637) [0x7f22c3e6d637] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x6d83) [0x7f22c469bd83] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x123) [0x7f22c469bed3] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc14e) [0x7f22c46a114e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x19) [0x7f22c502d429] -> dovecot/indexer-worker() [0x40237c] -> /usr/lib64/dovecot/libdovecot.so.0(io _loop_call_io+0x4c) [0x7f22c4d8f55c] -> /usr/lib64/dovecot/libdovecot.s o.0(io_loop_handler_run_internal+0xbb) [0x7f22c4d9049b] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7f22c4d8f5c9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f22c4d8f648] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f22c4d33703] -> dovecot/indexer-worker(main+0xcb) [0x401e7b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x32c6021d65] -> dovecot/indexer-worker() [0x401f25] Mar 12 20:49:17 indexer: Error: Indexer worker disconnected, discarding 6 requests for laeeth(a)kaleidicassociates.com Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Fatal: master: service(indexer-worker): child 24020 killed with signal 6 (core dumps disabled) Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Warning: I/O leak: 0x7f0d5aa00cf0 (line 127, fd 23) Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Panic: file ioloop-iolist.c: line 22: unreached Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7f0d5aa30c40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7f0d5aa30d1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f0d5a9e12e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x88a0d) [0x7f0d5aa42a0d] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handle_add+0x3b) [0x7f0d5aa4319b] -> /usr/lib64/dovecot/libdovecot.so.0(+0x87b61) [0x7f0d5aa41b61] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_move_io+0x3e) [0x7f0d5aa4283e] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7f0d5aa2eb14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7f0d5aa0

2 1

[Dovecot] imapc - different settings for different namespaces
by Timo Sirainen 20 Mar '15

20 Mar '15

Originally I was planning on allowing all kinds of mail settings inside namespace {}, including imapc_* settings. But that's a bit difficult to implement (although I think it will happen some day). So for now I was thinking: imapc foo { host = imap.foo.com master_user = foomaster password = foopass } imapc bar { host = imap.bar.com ... } namespace { prefix = foo/ location = imapc:foo } namespace { prefix = bar/ location = imapc:bar } So basically if the path after imapc isn't absolute (/path or ~/path), then treat the path as the imapc section name and use its settings. Anyone have any improvement suggestions? I was planning on adding this to v2.2.3. I'm not sure if the section names should be "imapc" or something else (e.g. imap_remote {}).

2 2

core not dumped
by James 20 Mar '15

20 Mar '15

There is some underlying problem with imap-login but in order to debug it I'd like to see a core file. On error dovecot reports "core not dumped". If I put "abort()" in the code at the point it is reporting then a core file is written, so there is no OS reason why a core can not be written. It appears to be dovecot's choice to control the child. In an attempt to obtain a core file I have: service imap-login { chroot = drop_priv_before_exec = yes user = dovecot } How can I make imap-login to produce a core file? Syslog error report: Mar 18 09:22:28 MAILHOST dovecot: [ID 583609 mail.crit] imap-login: Fatal: master: service(imap-login): child 10812 killed with signal 11 (core not dumped) [last ip=111.222.333.444] Should anyone care at this point (before I've looked at a core file) the error is related to; imap-login: Disconnected (no auth attempts in 0 secs): user=<>, James.

3 4

Re: fast doveadm search results
by Joseph Tam 20 Mar '15

20 Mar '15

Vu Ngoc VU <vvu(a)mcra.fr> writes: > My goal is to be able to find mails quickly with "doveadm search". > We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. > These messages are "unwanted" ones: mistakenly sent, defamatory... > > So, that situations appear rarely, but when asked, they expected me to > deleted quickly these messages from few to thousands of users > mailboxes. > > Is that possible to change behaviour of Dovecot, some headers like > sender, message-id, date are stored in cache for at least 48h? (7 days > would be better). So is this a fair summary of what you are asking: you want to load dovecot's caches with searchable items (i.e. specified headers) *and* have them expire and removed from caches after a preset amount of time? Caches are persistent: once an item is cached, it stays in the cache. I can't think of a good way to purge them without a lot of bother, but maybe you don't really need this. If you want to preload the cache with searchable items, you can periodically run a search/fetch command, which will load the cache with headers you want. http://www.dovecot.org/list/dovecot/2010-October/053521.html Maybe you can even add these items into the cache upon delivery, but someone more knowlegable than I would have to help you with that. The FTS/Solr plugin might also help. You seem to be optimizing the wrong problem. Reading between the lines of your message, your management wants a technical solution to a human problem (someone did an oops). Joseph Tam <jtam.home(a)gmail.com>

1 0

Released Pigeonhole v0.4.7 for Dovecot v2.2.16
by Stephan Bosch 20 Mar '15

20 Mar '15

Hello Dovecot users, Here is the final 0.4.7 release. No changes were committed since the last release candidate. Changelog v0.4.7: * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

check if anvil is working
by Leonardo Rodrigues 19 Mar '15

19 Mar '15

Hi, Is there any way of making sure the anvil service, used to penalty login fails, is working ? I dont see anything on the logs regarding it neither have it configured. It's not on my configuration files, but it can be seen on a 'dovecot -a' dump. Should it be logging something ? Should i have enabled it somehow ? Thanks for the answers. [root@correio log]# dovecot --version 2.2.13 (from dovecot -a dump) service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

fast doveadm search results
by Vu Ngoc VU 19 Mar '15

19 Mar '15

hello, I've posted same question here months ago. But obtaine no answer, even not a "you question is stupid". So I don't know what to think about that. My goal is to be able to find mails quickly with "doveadm search". We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. These messages are "unwanted" ones: mistakenly sent, defamatory... So, that situations appear rarely, but when asked, they expected me to deleted quickly these messages from few to thousands of users mailboxes. Is that possible to change behaviour of Dovecot, some headers like sender, message-id, date are stored in cache for at least 48h? (7 days would be better). I've read this page : http://wiki2.dovecot.org/Design/Indexes/Cache but cannot understand every parts. "A specific decision can be forced by ORing it with MAIL_CACHE_DECISION_FORCED." Is OR in this sentence like AND/OR comparators? Where to put "MAIL_CACHE_DECISION_FORCED"? "mail-cache-decisions.c file contains the rules how Dovecot changes the decisions." <-- is it in this file? My setup is 2.2.9 on Ubuntu 14.04 running on OpenVZ containers with 2 Director and 2 imap/pop3 backends. The storage is shared via NFS. Is this the performance problem? If dovecot has metadata I want in its cache, I cannot see how this is a problem. Can these settings be useful for my case? mail_always_cache_fields = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_never_cache_fields = imap.envelope Thanks.

2 2