This patch allows the dovecot proxy processes to lookup the destination host by name instead of IP address. Tested agains 1.2.10, expected to work against 1.2.11.

The patch is pretty straightforward, it's making it work within the restrictions of the login process that's more interesting.

I have made some changes to the wiki (pending approval) to

• enhance the discussion of proxy with LDAP http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy
• discuss the implication of this patch w.r.t. the login_chroot configuration parameter: http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy/HostLookup

Feedback is appreciated, particulary from a security standpoint.

Cheers,

-Martin Foster martin_foster@netlog.net

dump of wiki info, for the lazy. It will look better if viewed from the URL: http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy/HostLookup

For all released versions of Dovecot, the "host" referred to in a proxy or proxy_maybe lookup must be an IP address

see: the main PasswordDatabase/ExtraFields/Proxy <http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy> page for more info

A patch is available to enable lookups, but it has some imporant caveats due to the nature of the LoginProcess <http://wiki.dovecot.org/LoginProcess> that the proxy function is a part of. This page exists to discuss these.

The Problem

Proxying is done from the dovecot login processes, both pop3-login & imap-login call code in src/login-common/login-proxy.c to handle the proxying to the given host.

If the host is not an IP address, name resolution must be done. Two options from dovecot's configuration:

  1. Dovecot running with roots

Dovecot is started as root and drops privileges later; this is the recommended way of running Dovecot. Set by the config option: login_chroot = yes.

In this mode, the login process is chrooted to login_dir, from which the proposed patch adds name resolution. Resolution is done via dovecot's net_gethostbyname() function - a wrapper for getaddrinfo/gethostbyname depending on compile-time platform support.

These functions need access to the name service switch configuration, then whatever dependencies are required to consult the host resolution databases stipulated.

so, if the /etc/nsswitch.conf hosts entry is:

hosts: dns files

Then the system will need access to /etc/resolv.conf and the nss_dns libraries for "dns" lookup, and /etc/hosts for "files" lookup.

The exact files will vary by platform/operating system, but these all need to be available in the chroot for the lookup to succeed.

and, if dovecot.conf has:

login_chroot = yes login_dir = /var/run/dovecot/login login_user = dovecotuser

Then for the nsswitch.conf entry above, the following files need to be copied (not symbolically linked!) to the chroot. This example is for a 64-bit RHEL5 system, with 64-bit dovecot daemon. Ownership of the new directories must be set to whatever the login_user is set to.

mkdir /var/run/dovecot/login/etc mkdir /var/run/dovecot/login/lib64 cp /etc/nsswitch.conf /etc/resolv.conf /etc/hosts /var/run/dovecot/login/etc cp /lib64/libnss_dns.so.2 /var/run/dovecot/login/lib64 chown -R dovecotuser:dovecotuser /var/run/dovecot/login/etc chown -R dovecotuser:dovecotuser /var/run/dovecot/login/lib64

Remember that the ownership of the login_dir itself *must not* be changed. So:

# ls -ld /var/run/dovecot/login/ drwxr-x--- 4 root dovecotuser 4096 Mar 12 06:48 /var/run/dovecot/login/

    Troubleshooting

If the lookup fails because of a perceived lookup-in-chroot issue, an error message of this form will be printed to the logs

dovecot: pop3-login: proxy(test@domain1.test): cannot resolve mailhost.domain1.test. If name resolution is working outside dovecot, it may be a chroot issue. See LoginProcess on wiki, and login_dir& login_chroot in config.

Clients will receive a much less descript general error message, for example with POP3:

-ERR [IN-USE] Account is temporarily unavailable.

Things to check

1. does name resolution work for normal users? the dovecot user?

2. are all the files required by the Name Service Switch's configuration available? Use a process tracing tool such as strace or truss against the pop3-login or imap-login processes to check.

3. are other security measures interfering? eg: 1.

     SELinux
     <http://en.wikipedia.org/wiki/Security-Enhanced_Linux>
     (RedHat <http://www.redhat.com/rhel/> EL, CentOS, Oracle EL)

   2.

     AppArmor <http://en.wikipedia.org/wiki/AppArmor> (SuSE,
     Ubuntu?)

   3.

     RBAC (Solaris, OpenSolaris
     <http://en.wikipedia.org/wiki/Open_Solaris>)

   Caveats

This procedure allows the chroot'ed login to do something, which forms a security risk if the libraries in the chroot are exploitable.

It will be up to the operator to ensure that the copy of the files in the chroot get updated whenver the copies in the real filesystem do. On systems where the chroot is on the same filesystem/partition that the original file copies are, hard links (again: no soft links!) could be used to accomplish this.

  2. Dovecot running without roots (RootLess)

Dovecot is started as whatever user/group is used to start the master daemon. See the discussion on Rootless <http://wiki.dovecot.org/HowTo/Rootless> for reasons why this is not the recommended way of running Dovecot, which includes a discussion on how this is more likely to be less secure.

In dovecot.conf, rootless is selected by setting:

login_chroot = no

In this mode, the login process will have access to the required Name Service Switch configuration files and their dependencies if the user that started dovecot did.

No further configuration is required for the proxy process to lookup hostnames.