- dovecot - dovecot.org

Re: [Dovecot] Heartbleed openssl vulnerability?
by Jake Alley 09 Apr '14

09 Apr '14

It's an interesting issue. In my experience "stale" passwords are rarely used to compromise systems. However, passwords tend to end up on sticky notes and even worse, in email databases regardless. As far as compromised email passwords, they seem to mostly come from infected clients and insecure public logins as far as I can tell. A server can control the later, but not the former. I know of a major accounting software that forces Admin users to change their passwords every few months under certain circumstances. Those passwords always end up in emails to fellow users, so in that case forcing people to change seems to be definitely counterproductive. IMV the moral of the story is that you can't crypt your way into a 100% secure world. You need other forms of checks & reconciliations that are disjoint from purely cryptographic infrastructure. For instance ask Mt. Gox and Bitcoin if they agree in hindsight, and Heartbleed is a very good example of this concept. Thanks, Jake On 4/9/2014 10:27 AM, Reindl Harald wrote: "change passwords from time to time is always clever" is a strawmans argument with no context to the issue, forcing people to change their passwords all the time for no good reasons leads mostly to completly insecured passwords to remember them easier or have them on a sticky on the screen or under the keyboard the word "counterproductive" describes that policies perfectly

1 0

[Dovecot] Migration to Dovecot 2.2.12 - How to trigger full site indexing
by kadafax＠gmail.com 09 Apr '14

09 Apr '14

Hi list, We are in the process of migrating our old (dovecot 1.2.4 based) mail system to the new one: - Centos 6 x86_64 - Dovecot 2.2.12 - Users in an openldap directory - clucene FTS I'm trying to trigger a full indexing for all the user and all their mailboxes (avoiding them to individually trigger it using a search within their MUA). I'm trying to use the "doveadm index" command. First question, is there some sort of 'wildcard' option for the name of the mailbox to index, as I dont know all the mailboxes's names the users have created (beside the regular Sent Inbox Trash and Drafts ? Second question I've tried: # doveadm -D index -A Sent which gave me: doveadm(root): Error: User listing returned failure doveadm: Error: Failed to iterate through some users Can the '-A' option work with ldap backend ? Thanks a lot and have a nice day, kfx --------------------------------------------- # 2.2.12: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.11.2.el6.x86_64 x86_64 CentOS release 6.5 (Final) ext4 auth_cache_size = 10 M auth_debug = yes auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = sha1 base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-debug.log default_vsz_limit = 2 G hostname = mydomain.com info_log_path = /var/log/dovecot.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * log_path = /var/log/dovecot-error.log login_greeting = Welcome login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_debug = yes mail_gid = vmail mail_location = maildir:/var/vmail/%Ln mail_plugins = fts fts_lucene quota stats mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = maildir:/var/vmail/%Ln mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { args = /usr/local/etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = lucene fts_autoindex = yes fts_autoindex_max_recent = 1000 fts_lucene = whitespace_chars=@ quota = maildir:User quota quota_rule = *:storage=20GB quota_rule2 = Trash:storage=+200M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /var/sieve-scripts/%Ln.sieve sieve_dir = /var/vmail/%Ln/home/sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 16 M stats_refresh = 30 secs stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours } postmaster_address = postmaster(a)mydomain.com protocols = imap pop3 sieve sieve service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0777 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 5 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = nobody } service stats { fifo_listener stats-mail { mode = 0600 user = vmail } } ssl_cert = </etc/pki/tls/certs/mail.mydomain.com.pem ssl_key = </etc/pki/tls/private/mail.mydomain.com.key userdb { args = uid=12347 gid=12347 home=/var/vmail/%Ln/home allow_all_users=yes driver = static } verbose_proctitle = yes protocol lda { mail_plugins = fts fts_lucene quota stats sieve virtual } protocol imap { mail_plugins = fts fts_lucene quota stats imap_quota virtual imap_stats }

2 2

[Dovecot] POP3 sessions
by The Doctor 09 Apr '14

09 Apr '14

Is their a way in the config file to not lock POP3 sessions in dovecot for only 1 user? -- Member - Liberal International This is doctor(a)nl2k.ab.ca Ici doctor(a)nl2k.ab.ca God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! http://www.fullyfollow.me/rootnl2k Look at Psalms 14 and 53 on Atheism C'est temps pour le Quebec de voter aujourd'hui.

2 1

[Dovecot] Dovecot LDAP issue
by Deeztek Support 08 Apr '14

08 Apr '14

Dovecot version: 2.0.19 ------------------------------------------------------- grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-ldap.conf hosts = server.domain.tld:389 ldap_version = 3 auth_bind = yes dn = vmail(a)domain.tld dnpass = somepassword base = ou=testou,dc=domain,dc=tld scope = subtree deref = never user_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(userPrincipalName=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_attrs = userPassword=password default_pass_scheme = CRYPT user_attrs = =home=/var/vmail/vmail1/%Ld/%Ln/Maildir/,=mail=maildir:/var/vmail/vmail1/%Ld/%Ln/Maildir ----------------------------------------------------- I'm authenticating users through AD and it seems to work with no problems. Unfortunately, when I try to send e-mail from a user who's not in the testou container I get the following error: Sender address rejected: User unknown in virtual mailbox table> #SMTP#. I'm assuming this happens because dovecot is not able to to lookup up that user since that user is outside the testou container. A lot of the AD users are in different places inside the AD structure and I need to be able to configure dovecot to look from the root of the AD structure down. I changed the base to this: base = dc=domain,dc=tld but it simply fails to lookup any users at that point. How would I go about getting dovecot to start at the top of the domain and look at every nested OU within AD? thanks a lot D

6 12

[Dovecot] Debugging doveadm expunge
by Andy Hawkins 08 Apr '14

08 Apr '14

Hi, I'm a recent convert to dovecot, and in general it is all working fine. However, I have a number of cron jobs set up to purge old messages from mailboxes. These don't seem to be doing what I would expect. Is there any way of debugging this process? Some way of seeing what messages it's checking, and why each one matches or fails to match? For example, I'm running this: doveadm expunge -u andy mailbox "News Reports" savedbefore 90d from the crontab of user 'andy'. I'd expect the specified folder to only contain 90 messages (I get one 'News Report' per day) but in actual fact there are 1428 in there! Any advice would be appreciated. Thanks Andy

2 2

Re: [Dovecot] Connection refused userdb lookup ..dovecot/auth-userdb
by Simon 08 Apr '14

08 Apr '14

On Tue, Apr 1, 2014 at 11:29 PM, Steffen Kaiser < skdovecot(a)smail.inf.fh-brs.de> wrote: > >>>>>>>>> >>>>>>>>> > What's the output of: >>> >>> lsof -c dovecot|grep auth-userdb >>> >>> [root@vmail1 ~]# lsof -c dovecot|grep auth-userdb >> dovecot 3147 root 38u unix 0xffff88004fce0680 0t0 24739 >> /var/run/dovecot/auth-userdb >> > > Dovecot is configured to use /var/run/dovecot/auth-userdb whereas your LDA > uses /usr/local/dovecot/var/run/dovecot/auth-userdb . You do not have > symlinks to merge both locations, do you? > > Check, why the Dovecot LDA is using another config file. Found it!!!!!!! Thank youm thank you, thank you... this was delivery config in postfix that was using /usr/local/dovecot/var/run/dovecot/auth-userdb. DUH! Simon

1 0

[Dovecot] dsync replication questions
by Nikolaos Milas 07 Apr '14

07 Apr '14

I am running two servers with Dovecot v2.2.12 on CentOS x86_64 (5.10 and 6.5 respectively) and users are virtual over ldap. I have setup our main internal server (vmail.example.com) with dsync replication according to the first part of http://wiki2.dovecot.org/Replication. The second one (vmail1.example.com) will be the failover server which we want to be a real-time mirror (but can be manipulated directly and it should propagate changes back to vmail.example.com) When I started the server (vmail.example.com) mirroring started and completed fine (after a few hours). However, since then, I am not seeing a continued mirroring between the two. I would expect changes to one of the masters to be propagated in real time to the other - which does not happen. If I manually run (on vmail.example.com) dsync -u imaptester mirror ssh -l root vmail1.example.com dsync -u imaptester then these two accounts are synced. Question 1: Shouldn't mirroring continue automatically in real time (having configured it as in the first part of http://wiki2.dovecot.org/Replication)? If not, what should I do to enable such a real-time (or near-real-time) sync? Note that I have not configured "replication_dsync_parameters" as noted at the above page. Question 2: Where can I find documentation about "replication_dsync_parameters" and about "the doveadm sync command" (referred to at the same page)? I have not been able to locate such a documentation/wiki page. Question 2a: What do options "-d -N -l 30 -U" signify in "replication_dsync_parameters = -d -N -l 30 -U"? Thanks, Nick

4 11

[Dovecot] Regarding SSHA512 Password Scheme
by Joy 07 Apr '14

07 Apr '14

Dear Expert, I am having issue with using SSHA512 Password Schemes with my openldap server. I have used doveadm utility to create password and able to verify the same but trying to login to IMAP is failing tried debug the auth part but no success so far. I am using the latest version of dovecot. Please share your views .. Thanks

2 1

[Dovecot] Dovecot IMAP Authentication issue with Vpopmail
by Arup 07 Apr '14

07 Apr '14

Hello All, i've configured a qmail server (for office) under Ubuntu 12.04 server following this guide- http://www.connor.net.au/tutorials/qmail/qmaillite/ everything working just fine except dovecot IMAP. i've followed this section for dovecot- http://www.connor.net.au/tutorials/q...te/dovecot.php<http://www.connor.net.au/tutorials/qmail/qmaillite/dovecot.php> but when i go to telnet 143 and try to login with username/password, it failed and showing error: ** BYE Internal error occurred. Refer to server log for more information.Connection closed by foreign host.* i think there may be some authentication issue with vpopmail and dovecot. POP and SMTP both working. but why not IMAP? i can't also use webmail (i.e. squirrelmail) as it don't working with IMAP. it's showing- *connection dropped by IMAP server *error while trying to login. i'm looking forward to a solution here. any qmail+vpopmail expert here? plz help. Thanks in advance. B/R

1 0

[Dovecot] Unknown setting: plugin after fresh install
by Patrik Karisch 04 Apr '14

04 Apr '14

Hi guys, I've installed dovecot 2.1.7 on a Debian Wheezy, tweaked some parameters little bit, but I can't restart it (dovecot -n also fails) and get this error: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/90-acl.conf line 11: Unknown setting: plugin doveconf: Error: managesieve-login: dump-capability process returned 89 Wether I uncomment this plugin line, I get the error on another file (example 90-quote.conf). Seems a little bit weird. What have I done false? Thanks Patrik -- PRIVACY IS NOT A CRIME! So please encrypt your emails using PGP/GnuPG. My PGP Key-ID: 0x42D6DEA0 / 0x28B8F6E242D6DEA0 PGP Fingerprint: 4C1F ED51 047A D0E2 6C20 F3F7 28B8 F6E2 42D6 DEA0

2 2