- dovecot - dovecot.org

Mangesieve security question
by Vijay Rajah 24 Jun '14

24 Jun '14

Hello, I have a dovecot 2.2.6 on a Linux platform. I have configured manageseive extension. I have opened the manageseive port (4190) to entire world. (since I need my thunderbird and other clients to create seive scripts). I just wanted to know if it is ok to open that port to everyone, and get some feedback on some security measures specific to manageseive. -Thanks in advance Vijay PS: I have taken reasonable server hardening measures. This question is specific to manageseive.

2 1

Wishlist: add a variable %{x509} expanding to the client cert in Dovecot-auth
by Guilhem Moulin 24 Jun '14

24 Jun '14

Hi there, As of Dovecot 2.2.9, it's possible to enable passwordless authentication using client certificates [1]: ssl_ca = </etc/ssl/ca.pem ssl_verify_client_cert = yes auth_ssl_username_from_cert = yes (Password checking can be bypassed by returning the extra fields ‘password= nopassword’ in the passdb when the variable ‘%k’ expands to "valid".) However this requires the server admin to set up a PKI. Having a variable %{x509} expanding to the X.509 client cert in Dovecot-auth would remove such hassle and instead provide a way to manage authorized clients in the fashion of OpenSSH's ‘authorized_keys’. Postfix has a similar configuration option: relay_clientcerts [2]. There, the keys for the lookup table can be either client cert fingerprints or public key fingerprints (the digest algorithm can be configured with smtpd_tls_fingerprint_digest). I can't see why %{x509} should digest the certificate and not merely PEM-encode it, but having another %{pubkey} variable expanding to the (PEM-encoded) cert's SubjectPublicKeyInfo block would surely be useful :-) I wonder if there are other folks interested in having the client cert available in the passdb. Thanks, cheers, -- Guilhem. [1] http://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verifi… [2] http://www.postfix.org/postconf.5.html#relay_clientcerts

1 0

ACL group-override question
by Peter Chiochetti 23 Jun '14

23 Jun '14

Trying to get ACLs working, very basic setup: Virtual users are put into different acl_group via passdb. > u:{PLAIN}B::::::userdb_acl_groups=g The global acl file restricts what they can do. > * group-override=g > * group=g lr Shouldn't this mean, that the group rights override the user rights? The effect that I see though is, that the user "u" then may not do anything, not even lookup and read. The wiki text is not fully clear to me: It tells about disabling access fully (probably by specifying a non-existent group?). But this can only be one way to use group_override… -- peter

1 2

Dovecot authentication against active directory
by Tobias Dummert 23 Jun '14

23 Jun '14

Hello, i´ve got a problem with the dovecot authentication against active directory. I´m using dovecot 2.0.19 and windows server 2008 R2. When I try to login via telnet I get the following error message: a NO [AUTHENTICATIONFAILED] Authentication failed. My dovecot configuration: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-60-generic x86_64 Ubuntu 12.04.4 LTS ext4 auth_mechanisms = plain login auth_username_format = %Lu disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 last_valid_gid = 1001 last_valid_uid = 1001 log_path = /var/log/dovecot.log mail_location = maildir:/srv/mail/%u passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocols = imap ssl = no syslog_facility = local7 userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } valid_chroot_dirs = /srv/mail My dovecot-ldap.conf: hosts = ************** dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de dnpass = **************** tls = no debug_level = -1 ldap_version = 2 base = OU=*****,DC=*****,DC=*****,DC=de deref = never scope = subtree user_attrs = sAMAccountName=home user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u))) pass_filter = (&(ObjectClass=user)(sAMAccountName=%u)) default_pass_scheme = plain could anybody help me with this problem? Thanks in advance! Regards, Tobias Dummert

2 1

ACL group vs. owner question
by Peter Chiochetti 23 Jun '14

23 Jun '14

A hopefully simple question regarding the use of ACLs - the spirit being of taking away most permissions first and then adding them back selectively: In the global ACL declaration I have: > * owner lr > * group=SYS lrwstipekxa The owner is put into the SYS group via userdb extra field in static passwd file ("archiv" is a system user, but pam is disabled for the server): > archiv:::::::userdb_acl_groups=SYS Still, the group permissions do not get applied: > root@host:/etc/dovecot# doveadm -D acl debug -u archiv INBOX > […] > doveadm(archiv): Debug: Added userdb setting: plugin/acl_groups=SYS > doveadm(archiv): Debug: Effective uid=1002, gid=1001, home=/home/archiv > doveadm(archiv): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled > doveadm(archiv): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir > doveadm(archiv): Debug: maildir++: root=/home/archiv/Maildir, index=, indexpvt=, control=, inbox=/home/archiv/Maildir, alt= > doveadm(archiv): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl > doveadm(archiv): Debug: acl: acl username = archiv > doveadm(archiv): Debug: acl: owner = 1 > doveadm(archiv): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl > doveadm(archiv): Info: Mailbox 'INBOX' is in namespace '' > doveadm(archiv): Info: Mailbox path: /home/archiv/Maildir > doveadm(archiv): Info: All message flags are shared across users in mailbox > doveadm(archiv): Debug: acl vfile: file /home/archiv/Maildir/dovecot-acl not found > doveadm(archiv): Info: User archiv has rights: lookup read > doveadm(archiv): Info: Mailbox in user's private namespace > doveadm(archiv): Info: Mailbox INBOX is visible in LIST My question: Shouldn't this work? (In a stock setup.) PS: when I add "* group-override=SYS" to /etc/dovecot/dovecot-acl the user will not even be able to list INBOX. PPS: As an aside, the setup also switches any sytem or /virtual/ users during login in local.conf: > userdb { > driver = static > args = uid=archiv gid=archiv home=/home/archiv user=archiv > } but I get the above result without that switching when I make it read: > userdb { > driver = static > args = home=/home/archiv > } So I suppose that it's not relevant in this case… Thank you in advance -- peter

2 2

dovecot sieve vacation + lmtp protocol
by Florin Portase 23 Jun '14

23 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Here is my setup: dovecot - 2.2.11 pigeonhole - 0.4.2 qmail I was trying to create a vacation message, but after the sive script has been created and I was checking the logs I saw some strange errors: DOVECOT LOG Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: lmtp client: connect(medianetork.ro, 25) failed: Connection refused Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: smtp(medianetork.ro): RCPT TO failed: 451 4.4.0 Remote server not answering (connect) Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: sieve: msgid=<OF380D0FC2.6E61F37A-ONC1257CFB.0051127E-C1257CFB.00511452(a)XXX.com>: failed to send vacation response to <ZZZ(a)XXX.com> (refer to server log for more information) DOVECOT config service lmtp { chroot = client_limit = 0 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = #inet_listener lmtp { # address = 0.0.0.0 # port = 24 #} unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 0 } protocol lmtp { #mail_fsync = optimized log_path = /var/log/dovecot/lmtp-errors.log info_log_path = /var/log//dovecot/lmtp.log mail_plugins = quota sieve autocreate expire } Am I missing something ??? Just to specify: domain medianetork.ro is accessible from outside on port 25 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTobZ9AAoJECEzxtLP+204AisH/2t83NS5GzFEv6JET3rJFW/k yN1/EM+Veg2CX7qvh0NPAQ/5/1f9MOdlyFUEs5vg1n2YGtBCfig6RFhP0OZNa2lK 38n99Vq3uutrTmviuv5pl4c8Jwlq68jlUlTK6DvKub58AVcqln6ljQt82HhfKl1+ lzQ/Igg6V9XT9vzcgdtumac4h+jNHuvoMv697dhK5/UfaV5tuFqKIHgLMampf4lz kc7x85xocK3C1+DQIepmpOgyHpjwBRi2KYzFii2s2jT0QWmhUHaD88BNnN8mkJxZ +1+IsWqyqSpxTx5ghIh0QiiUUBKmWcngRTs67PisDuVwvOmEy/ULkp1aEYwpD7Y= =3/1y -----END PGP SIGNATURE-----

3 3

Setting mail_attach_dir for destination on dsync
by Laeeth Isharc 23 Jun '14

23 Jun '14

Hi. What is the best way to do this, please ? I can override with -o but this applies to source as I read the docs. So I wish to do something like this dsync mirror -u myuser(a)me.com mdbox:/home/mail/myuser/mdboxcopy With either of: 1) attachments stored within message so mail_attachment_dir for dest being blank Or 2) attachments stored in a sub directory of mdboxcopy eg mdboxcopy/attach/ Timo hints that this is possible, but I cannot see how to do this, Any ideas ? Sent from my iPad

1 0

SIGSEGV in 2.2.13 with IMAP Proxying to an Exchange Server (dovecot/auth)
by Ralf Hildebrandt 22 Jun '14

22 Jun '14

Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug//usr/lib/dovecot/auth...done. done. Attaching to program: /usr/lib/dovecot/auth, process 29099 [New LWP 29099] Core was generated by `dovecot/auth'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 No locals. #1 imapc_connection_abort_commands_array (cmd_array=cmd_array@entry=0x2075270, dest_array=dest_array@entry=0x7fff4b6aa810, only_box=only_box@entry=0x0, keep_retriable=keep_retriable@entry=false) at imapc-connection.c:236 cmd = 0x7f40b61e3c1d <buffer_alloc+45> i = 0 #2 0x00007f40b534c69d in imapc_connection_abort_commands (conn=0x20751a0, only_box=0x0, keep_retriable=<optimized out>) at imapc-connection.c:250 cmdp = <optimized out> cmd = <optimized out> tmp_array = {arr = {buffer = 0x203f6a0, element_size = 8}, v = 0x203f6a0, v_modifiable = 0x203f6a0} reply = {state = IMAPC_COMMAND_STATE_DISCONNECTED, resp_text_key = 0x0, resp_text_value = 0x0, text_full = 0x7f40b534f6a6 "Disconnected from server", text_without_resp = 0x7f40b534f6a6 "Disconnected from server"} #3 0x00007f40b61f7d7f in io_loop_handle_timeouts_real (ioloop=0x2047790) at ioloop.c:410 timeout = 0x2077e00 item = 0x2077e00 tv = {tv_sec = 0, tv_usec = 0} tv_call = {tv_sec = 1403450802, tv_usec = 614093} t_id = 3 #4 io_loop_handle_timeouts (ioloop=ioloop@entry=0x2047790) at ioloop.c:423 _data_stack_cur_id = 2 #5 0x00007f40b61f8d34 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x2047790) at ioloop-epoll.c:193 ctx = 0x204d270 list = <optimized out> io = <optimized out> tv = {tv_sec = 29, tv_usec = 999992} events_count = <optimized out> msecs = 30000 ret = 0 i = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #6 0x00007f40b61f7ed9 in io_loop_handler_run (ioloop=ioloop@entry=0x2047790) at ioloop.c:488 No locals. #7 0x00007f40b61f7f58 in io_loop_run (ioloop=0x2047790) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #8 0x00007f40b61a7133 in master_service_run (service=0x2047620, callback=<optimized out>) at master-service.c:566 No locals. #9 0x000000000040b96b in main (argc=1, argv=0x2047390) at main.c:393 c = <optimized out> ----- End forwarded message ----- -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

1 0

SIGSEGV in 2.2.13 with IMAP Proxying to an Exchange Server
by Ralf Hildebrandt 22 Jun '14

22 Jun '14

Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug//usr/lib/dovecot/imap...done. done. Attaching to program: /usr/lib/dovecot/imap, process 28497 [New LWP 28497] Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 imapc_client_mailbox_cmd (box=0x0, callback=callback@entry=0x7fa3a78020e0 <imapc_simple_callback>, context=context@entry=0x7fffd738b940) at imapc-client.c:351 #0 imapc_client_mailbox_cmd (box=0x0, callback=callback@entry=0x7fa3a78020e0 <imapc_simple_callback>, context=context@entry=0x7fffd738b940) at imapc-client.c:351 cmd = <optimized out> __FUNCTION__ = "imapc_client_mailbox_cmd" #1 0x00007fa3a7802815 in imapc_mailbox_noop (mbox=mbox@entry=0x149d440) at imapc-storage.c:154 cmd = <optimized out> sctx = {client = 0x146c400, ret = -2} #2 0x00007fa3a7800d30 in imapc_mailbox_sync_init (box=0x149d440, flags=(MAILBOX_SYNC_FLAG_FULL_READ | MAILBOX_SYNC_FLAG_FIX_INCONSISTENT)) at imapc-sync.c:476 mbox = 0x149d440 list = <optimized out> capabilities = <optimized out> changes = true ret = 0 #3 0x00007fa3a78133c9 in mailbox_sync_init (box=box@entry=0x149d440, flags=(MAILBOX_SYNC_FLAG_FULL_READ | MAILBOX_SYNC_FLAG_FIX_INCONSISTENT)) at mail-storage.c:1677 _data_stack_cur_id = 4 ctx = <optimized out> #4 0x00007fa3a78134d7 in mailbox_sync (box=box@entry=0x149d440, flags=<optimized out>, flags@entry=MAILBOX_SYNC_FLAG_FULL_READ) at mail-storage.c:1725 ctx = 0x149d440 status = {sync_delayed_expunges = 0} #5 0x00007fa3a783ddcb in mailbox_expunge_all_data (box=0x149d440) at index-storage.c:648 ctx = 0x7fffd738bafc t = 0x7fffd738bafc mail = 0x0 search_args = 0x0 #6 index_storage_mailbox_delete (box=0x149d440) at index-storage.c:701 metadata = {guid = "\000\000\000\000\000\000\000\000\030\337z\247\000\000\000", virtual_size = 21615680, cache_fields = 0x0, precache_fields = (MAIL_FETCH_RECEIVED_DATE | MAIL_FETCH_SAVE_DATE | MAIL_FETCH_PHYSICAL_SIZE | MAIL_FETCH_IMAP_BODY | MAIL_FETCH_IMAP_ENVELOPE | MAIL_FETCH_HEADER_MD5 | MAIL_FETCH_UIDL_BACKEND | MAIL_FETCH_POP3_ORDER | unknown: 16777216), backend_ns_prefix = 0x7fa3a78144b0 <mailbox_open+16> "\211\302\061\300\205\322x\bH\203\304\030[]Ð\366\203\230\002", backend_ns_type = (unknown: 0)} status = {messages = 0, recent = 0, unseen = 21327392, uidvalidity = 0, uidnext = 1, first_unseen_seq = 0, first_recent_uid = 2806981817, last_cached_seq = 32675, highest_modseq = 21615680, highest_pvt_modseq = 140340866663231, keywords = 0x1, permanent_flags = 0, permanent_keywords = 0, allow_new_keywords = 0, nonpermanent_modseqs = 0, no_modseq_tracking = 0, have_guids = 0, have_save_guids = 0, have_only_guid128 = 0} ret_guid = <optimized out> #7 0x00007fa3a78146a7 in mailbox_delete (box=0x149d440) at mail-storage.c:1319 ret = <optimized out> #8 0x000000000040d0e1 in cmd_delete (cmd=0x148de40) at cmd-delete.c:39 client = <optimized out> ns = <optimized out> box = 0x149d440 name = 0x144c2b8 "postponed-msgs" errstr = <optimized out> error = 32767 disconnect = false #9 0x0000000000416cfc in command_exec (cmd=0x148de40) at imap-commands.c:158 hook = 0x14550e0 ret = <optimized out> #10 0x0000000000415d5f in client_command_input (cmd=0x148de40) at imap-client.c:778 client = 0x1499c10 command = <optimized out> __FUNCTION__ = "client_command_input" #11 0x0000000000415e15 in client_command_input (cmd=0x148de40) at imap-client.c:839 client = 0x1499c10 command = <optimized out> __FUNCTION__ = "client_command_input" #12 0x0000000000416115 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x1499c10) at imap-client.c:877 No locals. #13 client_handle_input (client=client@entry=0x1499c10) at imap-client.c:889 _data_stack_cur_id = 3 remove_io = false handled_commands = false __FUNCTION__ = "client_handle_input" #14 0x00000000004164a2 in client_input (client=0x1499c10) at imap-client.c:931 cmd = 0x1465630 output = 0x148dd30 bytes = 32 __FUNCTION__ = "client_input" #15 0x00007fa3a7547e6f in io_loop_call_io (io=0x148be10) at ioloop.c:441 ioloop = 0x1454730 t_id = 2 __FUNCTION__ = "io_loop_call_io" #16 0x00007fa3a7548d77 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x1454730) at ioloop-epoll.c:220 ctx = 0x14553c0 list = 0x1456e20 io = <optimized out> tv = {tv_sec = 4, tv_usec = 998377} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #17 0x00007fa3a7547ed9 in io_loop_handler_run (ioloop=ioloop@entry=0x1454730) at ioloop.c:488 No locals. #18 0x00007fa3a7547f58 in io_loop_run (ioloop=0x1454730) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #19 0x00007fa3a74f7133 in master_service_run (service=0x14545c0, callback=callback@entry=0x41ee50 <client_connected>) at master-service.c:566 No locals. #20 0x000000000040b06f in main (argc=1, argv=0x1454390) at main.c:400 set_roots = {0x426ca0 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x144c048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x41f200 <login_client_connected>, failure_callback = 0x41ef30 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 c = <optimized out> -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

1 0

config best practice
by Egbert 20 Jun '14

20 Jun '14

Hi! We will soon start upgrading our Ubuntu mail server (running 2.0.19) from 12.04.1 LTSto 14.04 LTS. The dovecot config is still pretty much in 1.x style; one flat file called dovecot.conf. I can easily switch to a dovecot.conf with the "!include" lines and rename my flat config file to local.conf. I've tested that and it works fine. I could also try to move all lines in local.conf to the different XX-.conf files in the conf.d subdir. What is wise and best practice? Should one edit the files in conf.d? Or will the files in conf.d be overwritten on an update of dovecot? Then I'll better stick to the way of working with the dovecot.conf with the !includes and local.conf and assume that all files in conf.d are default settings. TNX for any advise! Egbert Jan, HCC!hobbynet, NL

4 4