- dovecot - dovecot.org

[Dovecot] init script as provided http://wiki2.dovecot.org/DovecotInit
by Jess Portnoy 01 Nov '13

01 Nov '13

Hello list, I would add: # dovecot Startup script for the dovecot server # # chkconfig: - # processname: dovecot # config: /path/to/config # pidfile: /path/to/pid So that it supports the chkconfig used by RHEL and clones too. Also, maybe it should be installed by the Makefile's install target? it could then also set: DAEMON=/path/to/dovecot/daemon instead of: DAEMON=/usr/local/sbin/dovecot Cause naturally, it will know the prefix chosen. May the source be with you, Jess Portnoy

2 1

[Dovecot] Logging in to a virtual users Maildir
by Steve Downes 01 Nov '13

01 Nov '13

Trying to set up a mailserver to run exim4, dovecot2, (clamav procmail or similar not yet installed) on a virtual machine & access it from various hosts mostly using Mutt. So far no attempt at encryption although there are some pem files from a previous attempt & some evidence from the mutt debug file they may be being used . So far I have attempted to set up dovecot to by accessed by MUAs only & tried to access it from Mutt on on the mailserver virtual machine & on another on locally networked machine (no networking problems). When I open a local mutt I get the following:- 1) could not connect to vmail-s (connection refused) (vmail-s is the mailserver host) 2) mutt then opens, with a blank message screen 3) from mutt I then put C (open mailbox ? for list) & ?. 4) I then get a file list for the mailbox including all dovecot files but no mailbox files except cur. new, & tmp 5) if enter on ../ I get (presumably) /home/vmail/users/steve/ showing Maildir as the 2nd line 6) select Maildir gives me my inbox but continuing the process does not give me acces to any other folders. The files in my mailbox are from my previous version of Dovecot (V1*) but I have previously tried to start anew set of mailboxes with similar results. I enclose below:- my Dovecot.conf file My muttrc file a .muttdebug0 file Dovecot log files show nothing but Dovecot stop/start lines. Any pointers please? Steve --------------------------------- /etc/dovecot/dovecot.conf # based on Dovecot.org/HowTo/SimpleVirtualInstall # Dovecot version 2 # ASD 131028 protocols = imap # separate dovecot logging log_path = /var/log/dovecot.log # info_log_path = /var/log/dovecot-info.log info_log_path = /var/log/dovecot.log mail_debug=yes # disable ssl for now ssl = no disable_plaintext_auth = no # Maildir boxes mail_location = maildir:~/home/vmail/%u/Maildir # if your using pop3, you'll need this # pop3_uidl_format = %g # authentication configuration auth_verbose=yes auth_debug=yes auth_mechanisms=plain auth_debug_passwords=yes passdb { driver = passwd-file args = /etc/dovecot/passwd } userdb { driver = static args = uid=vmail gid=vmail home=/home/vmail/%u/Maildir } -------------------------------------------- ~/.mutt.muttrc # muttrc file started 131029 set mbox_type="Maildir" set spoolfile=imaps://steve@vmail-s/ set folder="/home/vmail/users/steve" unset mark_old set postponed="/home/vmail/users/steve/drafts/" set postpone=ask-yes set imap_check_subscribed set abort_nosubject=yes set include=yes set editor="emacsclient %s" set alias_file="/home/steve/.mutt/mutt-aliases --------------------------------------------- .muttdebug0 [2013-10-31 14:35:23] Mutt/1.5.21 (2010-09-15) debugging at level 2 [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc'. [2013-10-31 14:35:23] Reading configuration file '/usr/lib/mutt/source-muttrc.d|'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/charset.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/colors.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/compressed-folders.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/gpg.rc'. [2013-10-31 14:35:23] Reading configuration file '/etc/Muttrc.d/smime.rc'. [2013-10-31 14:35:23] Reading configuration file '/home/steve/.mutt/muttrc'. [2013-10-31 14:35:23] Reading imaps://steve@vmail-s/... [2013-10-31 14:35:23] Looking up vmail-s... [2013-10-31 14:35:23] Connecting to vmail-s... [2013-10-31 14:35:23] Connection failed. errno: 111... [2013-10-31 14:35:23] Could not connect to vmail-s (Connection refused). [2013-10-31 14:35:25] Connected to vmail-s:993 on fd=-1 [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... [2013-10-31 14:35:55] Scanning /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] Scanning /home/vmail/users/steve/Maildir... 0 [2013-10-31 14:35:55] ../mh.c:728: queueing 1382383788.2292_0.mail-s:2,Sa [2013-10-31 14:35:55] ../mh.c:728: queueing 1381593772.6226_1.mail-s:2,S [2013-10-31 14:35:55] ../mh.c:728: queueing 1382022143.2719_1.mail-s:2,S [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0/54 (0%) [2013-10-31 14:35:55] Reading /home/vmail/users/steve/Maildir... 0/54 (0%) [2013-10-31 14:35:55] parse_parameters: `boundary="==Multipart_Boundary_xc75j85x"' [2013-10-31 14:35:55] parse_parameter: `boundary' = `==Multipart_Boundary_xc75j85x' [2013-10-31 14:35:55] parse_parameters: `charset="us-ascii"' [2013-10-31 14:35:55] ../mh.c:773 maildir_add_to_context(): Considering [2013-10-31 14:35:55] ../mh.c:782 Adding header structure. Flags: OR [2013-10-31 14:35:55] ../mh.c:773 maildir_add_to_context(): Considering [2013-10-31 14:35:55] Sorting mailbox... (I have cut most of the repeated lines for each email out of this file)

2 1

[Dovecot] double login lines
by Andreas Meyer 31 Oct '13

31 Oct '13

Hi! Who can tell me why I have double login lines for some accounts? Oct 31 12:35:36 imap-login: Info: Login: user=<anmeyer(a)anup.de>, method=CRAM-MD5, rip=84.179.59.177, lip=78.47.3.18, mpid=29905, TLS, TLSv1 with cipher RC4-MD5 (128/128 bits) Oct 31 12:35:36 imap-login: Info: Login: user=<anmeyer(a)anup.de>, method=CRAM-MD5, rip=84.179.59.177, lip=78.47.3.18, mpid=29906, TLS, TLSv1 with cipher RC4-MD5 (128/128 bits) I can not think of any reason why this happens at the same time. Greetings Andreas

2 1

[Dovecot] dovecot-ldap : can't find user in OU subtree
by me＠electronico.nc 31 Oct '13

31 Oct '13

Hi all, Well, I've compiled and installed dovecot 2.2.6 with following options: > ./configure --prefix=/usr/ --sysconfdir=/etc/ --with-mysql > --libexecdir=/usr/lib/ --localstatedir=/var > --with-moduledir=/usr/lib/dovecot/modules --disable-rpath > --disable-static --with-zlib --with-bzlib --with-solr --with-ldap > --with-gssapi --with-nss doveconf -n: > # 2.2.6: /etc/dovecot/dovecot.conf > # OS: Linux 3.8.0-32-generic x86_64 Ubuntu 12.04.3 LTS ext4 > auth_debug = yes > auth_mechanisms = plain login > auth_verbose = yes > first_valid_gid = 20001 > first_valid_uid = 20001 > log_timestamp = %Y-%m-%d %H:%M:%S > mail_debug = yes > mail_gid = 20001 > mail_home = /media/data/email/%n > mail_location = maildir:/media/data/email/%n/mail > mail_plugins = fts fts_solr acl zlib mail_log notify > mail_uid = 20001 > managesieve_notify_capability = mailto > managesieve_sieve_capability = comparator-i;octet > comparator-i;ascii-casemap fileinto reject envelope encoded-character > vacation subaddress comparator-i;ascii-numeric relational regex > imap4flags copy include variables body enotify environment mailbox > date spamtest spamtestplus virustest > namespace { > list = no > location = > maildir:/media/data/email/%%n/mail:INDEX=/media/data/email/%n/mail/shared/%%n > prefix = shared/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = maildir:/media/data/email/%n/mail > mailbox Sent { > auto = subscribe > } > mailbox Spam { > auto = subscribe > } > mailbox SpamFalse { > auto = subscribe > } > mailbox SpamToLearn { > auto = subscribe > } > prefix = > separator = / > type = private > } > passdb { > args = /etc/dovecot/dovecot-ldap-passdb.conf.ext > driver = ldap > } > plugin { > acl = vfile > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename save mailbox_create > mail_log_fields = uid box msgid size > sieve = /media/data/email/%n/dovecot.sieve > sieve_after = /media/data/email/sieve/global.sieve > sieve_dir = /media/data/email/%n/sieve > zlib_save = bz2 > zlib_save_level = 9 > } > protocols = imap pop3 sieve lmtp > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0660 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0640 > user = vmail > } > } > service imap-login { > inet_listener imap { > address = * > port = 143 > } > inet_listener imaps { > address = * > port = 993 > ssl = yes > } > process_limit = 256 > } > service lmtp { > inet_listener lmtp { > address = * > port = 24 > } > user = vmail > } > service managesieve-login { > inet_listener sieve { > address = * > port = 4190 > } > process_limit = 256 > vsz_limit = 64 M > } > service pop3-login { > inet_listener pop3 { > address = * > port = 110 > } > inet_listener pop3s { > address = * > port = 995 > ssl = yes > } > } > ssl = required > ssl_ca = </etc/postfix/tls/cacert.pem > ssl_cert = </etc/postfix/tls/radiodjiido-cert.pem > ssl_key = </etc/postfix/tls/radiodjiido-key.pem > ssl_verify_client_cert = yes > userdb { > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > driver = ldap > } > protocol imap { > imap_client_workarounds = delay-newmail > imap_max_line_length = 64 k > mail_max_userip_connections = 20 > mail_plugins = acl imap_acl mail_log notify zlib > } > protocol pop3 { > mail_plugins = zlib mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } > protocol sieve { > managesieve_logout_format = bytes ( in=%i : out=%o ) > } > protocol lda { > info_log_path = > log_path = > mail_plugins = sieve zlib mail_log notify > quota_full_tempfail = yes > syslog_facility = mail > } > protocol lmtp { > info_log_path = > log_path = > mail_plugins = sieve fts zlib mail_log notify > quota_full_tempfail = yes > } /etc/dovecot/dovecot-ldap-passdb.conf.ext: > hosts = localhost > auth_bind = yes > auth_bind_userdn = cn=%u,OU=users,dc=domain,dc=lan > ldap_version = 3 > base = ou=users,dc=domain,dc=lan > scope = subtree > pass_filter = (&(objectClass=person)(cn=%u)(mail=*)) /etc/dovecot/dovecot-ldap-userdb.conf.ext: > hosts = localhost > dn = cn=ldap,cn=Users,DC=domain,DC=lan > dnpass = My_secret_pass > ldap_version = 3 > base = OU=users,DC=domain,DC=lan > scope = subtree > user_attrs = uid=20001, gid=20001, home=/media/data/email/%n, > mail=/media/data/email/%n/mail > user_filter = (&(objectClass=person)(cn=%n)(mail=*)) > iterate_attrs = cn=user > iterate_filter = (objectClass=person) All seems to work as expected up-to-now, but : If I move a user from OU 'users' to a sub-OU 'administrative' on Active Directory : -> The user can't login anymore to Dovecot I have added the "scope = subtree" to the userdb and passdb files but it doesn't change anything. Here is the debug part when user test3 (located in ou=users, ou=administrative) tries to login: > Oct 30 18:49:12 serveur dovecot: auth: Debug: auth client connected > (pid=4292) > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=L6uskfDpKwAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54827 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:49:12 serveur dovecot: auth: > ldap(test3,10.10.20.208,<L6uskfDpKwAKChTQ>): invalid credentials > Oct 30 18:49:14 serveur dovecot: auth: Debug: client passdb out: > FAIL#0111#011user=test3 As soon as I move user 'test3' back to ou=users, it can login ... > Oct 30 18:53:57 serveur dovecot: auth: Debug: Loading modules from > directory: /usr/lib/dovecot/modules/auth > Oct 30 18:53:57 serveur dovecot: auth: Debug: Read auth token secret > from /var/run/dovecot/auth-token-secret.dat > Oct 30 18:53:57 serveur dovecot: auth: Debug: auth client connected > (pid=4303) > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=h+ypovDpUAAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54864 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > OK#0111#011user=test3 Thanks in advance for your time and lights. Nicolas

3 5

[Dovecot] IMAP Dovecot unknown namespace creating root folders
by marcus lively 31 Oct '13

31 Oct '13

Hi, I hope someone can point me in the right direction here. I am migrating a mailbox from a non cPanel server, and the mailboxes have folders which seem to be at the same level as the Inbox. The users access these mailboxes using IMAP. The new server configuration is Exim > Dovecot 1.2.17 > Maildir with the standard cPanel install settings. dovecot -n output below I have created the new mailbox within cPanel however when I try to create a 'top level' folder in Outlook I receive the error 'Cannot create the folder: Unknown namespace' (Note I also tried this with the windows mail client to ensure it was not client side) I know that I can get round this by setting the root folder path on the client to 'Inbox' and therefore the folders would be created as sub-folders of Inbox, and this would not be visible to the user, but I was hoping to migrate without touching the clients. Should dovecot report the default root folder path automatically, or create a default top level namespace for each user so this can be done, or could I have just gone wrong and missed something. Any advice on getting this working appreciated, thanks for any help Maspry # 1.2.17: /etc/dovecot.conf # OS: Linux 2.6.32-71.el6.x86_64 x86_64 CentOS release 6.4 (Final) protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/dovecot/ssl/dovecot.crt ssl_key_file: /etc/dovecot/ssl/dovecot.key ssl_cipher_list: ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_process_per_connection: no login_processes_count: 2 login_max_processes_count: 50 login_max_connections: 500 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 3 maildir_copy_preserve_filename: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): acl quota imap_quota mail_plugins(imap): acl quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): UID%u-%v pop3_logout_format(default): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(imap): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(pop3): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster(a)example.com auth default: mechanisms: plain login cache_size: 1024 username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+% passdb: driver: checkpassword args: /usr/local/cpanel/bin/dovecot-auth userdb: driver: prefetch socket: type: listen client: path: /var/run/dovecot/auth-client mode: 438 plugin: quota: maildir quota_rule: Trash:ignore acl: vfile

2 2

Re: [Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 30 Oct '13

30 Oct '13

Currently our dovecot servers are on our webhosting linux boxes. We are using the LAMP stack to host websites, and also doing email with postfix & dovecot on these systems. We provide this as a hosting setup for 100+ accounts/websites on a single server (a multi-tenant setup). Each customer has anywhere between 1-100 email accounts which Dovecot services. If a customer has vulnerable PHP code on a website, some of these will allow a remote file upload. I have seen cases where they upload a PHP script that is a sort of web-based console/shell to the server (file-system, etc.). It provides several tools which all run through the uploaded PHP script to try to brute force and do other attacks. I've seen attempts at a root exploit. We've never had a root exploit and any such case of a customer's site being hacked has been easily contained by simple filesystem permissions being correct (and the fact that we have apache setup to run all scripts as the user who is the owner of the script files, which confines the script to that users' permissions). Still nobody loves the idea of bad guys trying to hack on your box. So.... given that type of scenario, if filesystem permissions weren't correct, or some new exploit surfaced that allowed someone bypass or elevate to root, then they could theoretically have access to the entire fileystem including where emails are stored. I hope to never have this sort of thing happen. We patch our systems regularly and have other security measures we follow to prevent this. We also are managing most of the PHP scripts customers use ourselves now and are updating those for the CMS' and other systems proactively. However, it would be nice to know that even if we were breached, the emails on the server were encrypted and would be completely useless to an attacker. This type of encryption is ideal and some regulations prefer (although don't require) it. - Doug Mortensen Network Consultant Impala Networks P: 505.327.7300 -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Michael Orlitzky Sent: Monday, October 28, 2013 11:52 AM To: dovecot Subject: Re: [Dovecot] Encryption solution for messages at rest On 10/28/2013 12:02 PM, Douglas Mortensen wrote: > Hi, > > We have clients with various security & compliance requirements. > Although not required, it would be ideal to have messages encrypted at > rest. You can rule out a lot of the crazier options by answering the questions, (a) What attack scenario do you have in mind? (b) How will encryption help?

11 15

[Dovecot] Right values for Antispam plugin
by Michael Neurohr 30 Oct '13

30 Oct '13

Hi! I'm currently configuring the Dovecot Antispam plugin for the use with Dspam. In general it works, but I'm not sure about one special config parameter: antispam_dspam_args At the moment I set it to: antispam_dspam_args = --source=error;--signature=%%s;--user;%u Is that the appropriate value for retraining? I'm not sure if "%%s" is correct to get the signature value. I was not able to find any documentation that describes that value. So I just want to know if my plugin config is correct for retraining. plugin { antispam_backend = dspam antispam_spam = Spam antispam_trash = trash;Trash;Deleted Items;Deleted Messages antispam_signature = X-DSPAM-Signature antispam_signature_missing = move antispam_dspam_binary = /usr/bin/dspam antispam_dspam_args = --source=error;--signature=%%s;--user;%u } Thanks, Michael

1 0

Re: [Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 30 Oct '13

30 Oct '13

So I suppose you're not a fan of the email hosting systems on the planet that bundle many services onto 1 box. Thanks for the feedback. - Doug Mortensen Network Consultant Impala Networks P: 505.327.7300 -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Alan Brown Sent: Tuesday, October 29, 2013 10:05 AM To: dovecot Subject: [Dovecot] Encryption solution for messages at rest > Date: Tue, 29 Oct 2013 08:54:04 +0100 > From: Robert Schetterer <rs(a)sys4.de> > To: dovecot(a)dovecot.org > Subject: Re: [Dovecot] Encryption solution for messages at rest > Message-ID: <526F699C.9080402(a)sys4.de> > Content-Type: text/plain; charset=ISO-8859-1 > > > you shouldnt host mail/imap services on the same servers with massive > http hosting, You shouldn't host anything else on a webserver FULLSTOP. Webservers are best treated as "disposable" and should be heavily sandboxed. Any resources they can use should be vetted and ideally set as "read only" Inbound external access should be firewalled down to the webserver ports and OUTBOUND traffic should be firewalled too (If it has no business initiating external connections then block all SYNs), in order to stop it becoming a DDoS zombie. It's foolish (at best) to have mail servers running on a webserver, because if it's compromised it can immediately be used as a spam engine without much further effort. At least if it has to hand mail off to another mailserver you have a chance to run outbound filtering on the emitted mail without worrying about that being compromised too.

1 0

[Dovecot] separate mail_location for system and normal users
by Andrzej A. Filip 30 Oct '13

30 Oct '13

How to configure dovecot to use different default mail_location for system (uid<1_000) and normal users (uid>=1_000)? I want to to use by default * classic mailbox in standard location for system users * maildir in $HOME subdirectory for normal users

2 3

[Dovecot] Disable unsecure POP3 at all (Dovecot 2.1)
by Андрей Кумыков 30 Oct '13

30 Oct '13

Hi to all. Is it possible to disable unsecure POP3 protocol at all in Dovecot 2.1? There was "protocols" option in 1.x version, and there was separate pop3 and pop3s modules. There is no "pop3s" in configuration files in 2.1.

3 2