- dovecot - dovecot.org

ot: accepting self certs into win pc?
by voytek＠sbt.net.au 24 Jun '14

24 Jun '14

few month ago, I've got a new Dovecot/Postfix server with self issued certificate (like the previous server), transferred users, all went well EXCEPT for one user on Win/Outlook (or Outlook Express) who tells me his new PC 'doesn't want to accept certificate' (sorry, I'm short on exact details at this time) I need to get it sorted out, I expect it 'should just work' like it did for other users, BUT, before I start looking, trying to 'educate myself' better if any one has any pointers, dos or don't regarding win email clients with self certified server, pls point me that way is using IE with www.dom.com/mycert.crt good point to start ? (after copying mycer.crt to web linked directory first?) thanks, V

7 17

Wheezy Dovecot workarounds
by Steve Litt 24 Jun '14

24 Jun '14

Hi all, In switching from Ubuntu to Debian Wheezy (7.5 64bit, network install), I'm finding some surprises in getting Dovecot to work. PROBLEM: As installed, the package manager doesn't give you the dovecot executable. WORKAROUND: To install the dovecot executable, you need to follow these instructions: http://wiki2.dovecot.org/HowTo/DebianStable PROBLEM: Even when you install Dovecot, it doesn't work, as evidenced by the inability of a local email client to talk to it. Further elements of the symptom are that nmap -A -T4 LocalIPAddress, whether LocalIPAddress is the IP of eth0, or 127.0.0.1, fails to find any open ports. Telnet can't operate dovecot at port 143, and openssl can't operate it at 993. However, bizarrly, executing these same commands on a remote machine into the original machine (including accessing the machine's Dovecot from an email client) work perfectly. WORKAROUND To "solve" this problem, do the following raindance as root: ifdown lo ifup lo After the raindance, local access to Dovecot works perfectly, and all nmap commands perform as expected. LOL, hey man, don't shoot me, I'm just the messenger. SteveT Steve Litt * http://www.troubleshooters.com/ Troubleshooting Training * Human Performance

4 3

Mangesieve security question
by Vijay Rajah 24 Jun '14

24 Jun '14

Hello, I have a dovecot 2.2.6 on a Linux platform. I have configured manageseive extension. I have opened the manageseive port (4190) to entire world. (since I need my thunderbird and other clients to create seive scripts). I just wanted to know if it is ok to open that port to everyone, and get some feedback on some security measures specific to manageseive. -Thanks in advance Vijay PS: I have taken reasonable server hardening measures. This question is specific to manageseive.

2 1

Wishlist: add a variable %{x509} expanding to the client cert in Dovecot-auth
by Guilhem Moulin 24 Jun '14

24 Jun '14

Hi there, As of Dovecot 2.2.9, it's possible to enable passwordless authentication using client certificates [1]: ssl_ca = </etc/ssl/ca.pem ssl_verify_client_cert = yes auth_ssl_username_from_cert = yes (Password checking can be bypassed by returning the extra fields ‘password= nopassword’ in the passdb when the variable ‘%k’ expands to "valid".) However this requires the server admin to set up a PKI. Having a variable %{x509} expanding to the X.509 client cert in Dovecot-auth would remove such hassle and instead provide a way to manage authorized clients in the fashion of OpenSSH's ‘authorized_keys’. Postfix has a similar configuration option: relay_clientcerts [2]. There, the keys for the lookup table can be either client cert fingerprints or public key fingerprints (the digest algorithm can be configured with smtpd_tls_fingerprint_digest). I can't see why %{x509} should digest the certificate and not merely PEM-encode it, but having another %{pubkey} variable expanding to the (PEM-encoded) cert's SubjectPublicKeyInfo block would surely be useful :-) I wonder if there are other folks interested in having the client cert available in the passdb. Thanks, cheers, -- Guilhem. [1] http://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verifi… [2] http://www.postfix.org/postconf.5.html#relay_clientcerts

1 0

ACL group-override question
by Peter Chiochetti 23 Jun '14

23 Jun '14

Trying to get ACLs working, very basic setup: Virtual users are put into different acl_group via passdb. > u:{PLAIN}B::::::userdb_acl_groups=g The global acl file restricts what they can do. > * group-override=g > * group=g lr Shouldn't this mean, that the group rights override the user rights? The effect that I see though is, that the user "u" then may not do anything, not even lookup and read. The wiki text is not fully clear to me: It tells about disabling access fully (probably by specifying a non-existent group?). But this can only be one way to use group_override… -- peter

1 2

Dovecot authentication against active directory
by Tobias Dummert 23 Jun '14

23 Jun '14

Hello, i´ve got a problem with the dovecot authentication against active directory. I´m using dovecot 2.0.19 and windows server 2008 R2. When I try to login via telnet I get the following error message: a NO [AUTHENTICATIONFAILED] Authentication failed. My dovecot configuration: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-60-generic x86_64 Ubuntu 12.04.4 LTS ext4 auth_mechanisms = plain login auth_username_format = %Lu disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 last_valid_gid = 1001 last_valid_uid = 1001 log_path = /var/log/dovecot.log mail_location = maildir:/srv/mail/%u passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocols = imap ssl = no syslog_facility = local7 userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } valid_chroot_dirs = /srv/mail My dovecot-ldap.conf: hosts = ************** dn = CN=*****,OU=*****,OU=*****,OU=*****,DC=******,DC=*****,DC=de dnpass = **************** tls = no debug_level = -1 ldap_version = 2 base = OU=*****,DC=*****,DC=*****,DC=de deref = never scope = subtree user_attrs = sAMAccountName=home user_filter = (&(ObjectClass=user)(|(mail=%u)(sAMAccountName=%u))) pass_filter = (&(ObjectClass=user)(sAMAccountName=%u)) default_pass_scheme = plain could anybody help me with this problem? Thanks in advance! Regards, Tobias Dummert

2 1

ACL group vs. owner question
by Peter Chiochetti 23 Jun '14

23 Jun '14

A hopefully simple question regarding the use of ACLs - the spirit being of taking away most permissions first and then adding them back selectively: In the global ACL declaration I have: > * owner lr > * group=SYS lrwstipekxa The owner is put into the SYS group via userdb extra field in static passwd file ("archiv" is a system user, but pam is disabled for the server): > archiv:::::::userdb_acl_groups=SYS Still, the group permissions do not get applied: > root@host:/etc/dovecot# doveadm -D acl debug -u archiv INBOX > […] > doveadm(archiv): Debug: Added userdb setting: plugin/acl_groups=SYS > doveadm(archiv): Debug: Effective uid=1002, gid=1001, home=/home/archiv > doveadm(archiv): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled > doveadm(archiv): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir > doveadm(archiv): Debug: maildir++: root=/home/archiv/Maildir, index=, indexpvt=, control=, inbox=/home/archiv/Maildir, alt= > doveadm(archiv): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl > doveadm(archiv): Debug: acl: acl username = archiv > doveadm(archiv): Debug: acl: owner = 1 > doveadm(archiv): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl > doveadm(archiv): Info: Mailbox 'INBOX' is in namespace '' > doveadm(archiv): Info: Mailbox path: /home/archiv/Maildir > doveadm(archiv): Info: All message flags are shared across users in mailbox > doveadm(archiv): Debug: acl vfile: file /home/archiv/Maildir/dovecot-acl not found > doveadm(archiv): Info: User archiv has rights: lookup read > doveadm(archiv): Info: Mailbox in user's private namespace > doveadm(archiv): Info: Mailbox INBOX is visible in LIST My question: Shouldn't this work? (In a stock setup.) PS: when I add "* group-override=SYS" to /etc/dovecot/dovecot-acl the user will not even be able to list INBOX. PPS: As an aside, the setup also switches any sytem or /virtual/ users during login in local.conf: > userdb { > driver = static > args = uid=archiv gid=archiv home=/home/archiv user=archiv > } but I get the above result without that switching when I make it read: > userdb { > driver = static > args = home=/home/archiv > } So I suppose that it's not relevant in this case… Thank you in advance -- peter

2 2

dovecot sieve vacation + lmtp protocol
by Florin Portase 23 Jun '14

23 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Here is my setup: dovecot - 2.2.11 pigeonhole - 0.4.2 qmail I was trying to create a vacation message, but after the sive script has been created and I was checking the logs I saw some strange errors: DOVECOT LOG Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: lmtp client: connect(medianetork.ro, 25) failed: Connection refused Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: smtp(medianetork.ro): RCPT TO failed: 451 4.4.0 Remote server not answering (connect) Jun 18 16:52:24 lda(portase.florin(a)medianetork.ro): Error: sieve: msgid=<OF380D0FC2.6E61F37A-ONC1257CFB.0051127E-C1257CFB.00511452(a)XXX.com>: failed to send vacation response to <ZZZ(a)XXX.com> (refer to server log for more information) DOVECOT config service lmtp { chroot = client_limit = 0 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = #inet_listener lmtp { # address = 0.0.0.0 # port = 24 #} unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 0 } protocol lmtp { #mail_fsync = optimized log_path = /var/log/dovecot/lmtp-errors.log info_log_path = /var/log//dovecot/lmtp.log mail_plugins = quota sieve autocreate expire } Am I missing something ??? Just to specify: domain medianetork.ro is accessible from outside on port 25 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTobZ9AAoJECEzxtLP+204AisH/2t83NS5GzFEv6JET3rJFW/k yN1/EM+Veg2CX7qvh0NPAQ/5/1f9MOdlyFUEs5vg1n2YGtBCfig6RFhP0OZNa2lK 38n99Vq3uutrTmviuv5pl4c8Jwlq68jlUlTK6DvKub58AVcqln6ljQt82HhfKl1+ lzQ/Igg6V9XT9vzcgdtumac4h+jNHuvoMv697dhK5/UfaV5tuFqKIHgLMampf4lz kc7x85xocK3C1+DQIepmpOgyHpjwBRi2KYzFii2s2jT0QWmhUHaD88BNnN8mkJxZ +1+IsWqyqSpxTx5ghIh0QiiUUBKmWcngRTs67PisDuVwvOmEy/ULkp1aEYwpD7Y= =3/1y -----END PGP SIGNATURE-----

3 3

Setting mail_attach_dir for destination on dsync
by Laeeth Isharc 23 Jun '14

23 Jun '14

Hi. What is the best way to do this, please ? I can override with -o but this applies to source as I read the docs. So I wish to do something like this dsync mirror -u myuser(a)me.com mdbox:/home/mail/myuser/mdboxcopy With either of: 1) attachments stored within message so mail_attachment_dir for dest being blank Or 2) attachments stored in a sub directory of mdboxcopy eg mdboxcopy/attach/ Timo hints that this is possible, but I cannot see how to do this, Any ideas ? Sent from my iPad

1 0

SIGSEGV in 2.2.13 with IMAP Proxying to an Exchange Server (dovecot/auth)
by Ralf Hildebrandt 22 Jun '14

22 Jun '14

Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug//usr/lib/dovecot/auth...done. done. Attaching to program: /usr/lib/dovecot/auth, process 29099 [New LWP 29099] Core was generated by `dovecot/auth'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 #0 0x00007f40b534c418 in array_append_i (count=<optimized out>, data=<optimized out>, array=<optimized out>) at ../../src/lib/array.h:148 No locals. #1 imapc_connection_abort_commands_array (cmd_array=cmd_array@entry=0x2075270, dest_array=dest_array@entry=0x7fff4b6aa810, only_box=only_box@entry=0x0, keep_retriable=keep_retriable@entry=false) at imapc-connection.c:236 cmd = 0x7f40b61e3c1d <buffer_alloc+45> i = 0 #2 0x00007f40b534c69d in imapc_connection_abort_commands (conn=0x20751a0, only_box=0x0, keep_retriable=<optimized out>) at imapc-connection.c:250 cmdp = <optimized out> cmd = <optimized out> tmp_array = {arr = {buffer = 0x203f6a0, element_size = 8}, v = 0x203f6a0, v_modifiable = 0x203f6a0} reply = {state = IMAPC_COMMAND_STATE_DISCONNECTED, resp_text_key = 0x0, resp_text_value = 0x0, text_full = 0x7f40b534f6a6 "Disconnected from server", text_without_resp = 0x7f40b534f6a6 "Disconnected from server"} #3 0x00007f40b61f7d7f in io_loop_handle_timeouts_real (ioloop=0x2047790) at ioloop.c:410 timeout = 0x2077e00 item = 0x2077e00 tv = {tv_sec = 0, tv_usec = 0} tv_call = {tv_sec = 1403450802, tv_usec = 614093} t_id = 3 #4 io_loop_handle_timeouts (ioloop=ioloop@entry=0x2047790) at ioloop.c:423 _data_stack_cur_id = 2 #5 0x00007f40b61f8d34 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x2047790) at ioloop-epoll.c:193 ctx = 0x204d270 list = <optimized out> io = <optimized out> tv = {tv_sec = 29, tv_usec = 999992} events_count = <optimized out> msecs = 30000 ret = 0 i = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #6 0x00007f40b61f7ed9 in io_loop_handler_run (ioloop=ioloop@entry=0x2047790) at ioloop.c:488 No locals. #7 0x00007f40b61f7f58 in io_loop_run (ioloop=0x2047790) at ioloop.c:465 __FUNCTION__ = "io_loop_run" #8 0x00007f40b61a7133 in master_service_run (service=0x2047620, callback=<optimized out>) at master-service.c:566 No locals. #9 0x000000000040b96b in main (argc=1, argv=0x2047390) at main.c:393 c = <optimized out> ----- End forwarded message ----- -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

1 0