March 2008 - dovecot - dovecot.org

[Dovecot] xexec and dovecot 1.1
by subscriber＠viliar.net.ru 19 Mar '08

19 Mar '08

I'll test very interesting plugin xexec. It seems very nice and can be used in many things. It's compiled perfect with dovecot 1.0, but certanly not with dovecot 1.1. It's stopped with next error: In file included from cmd-xexec.c:30: xexec.h:8: error: expected specifier-qualifier-list before 'array_t' cmd-xexec.c: In function 'cmd_xexec': cmd-xexec.c:134: error: 'array_t' undeclared (first use in this function) cmd-xexec.c:134: error: (Each undeclared identifier is reported only once cmd-… [View More]

2 1

[Dovecot] Remote resources in kde-pim
by Anne Wilson 18 Mar '08

18 Mar '08

For some time I have been using dovecot to serve imap mail on my LAN. Now I want to add my diary and addressbook in kde-pim. I have got the docs from the kde site, but they talk about cyrus, and I'm not able to translate some bits of the instructions into dovecot ones. For instance, "At cyrus level (in the PC that runs IMAP server cyrus, with cyrus tools), we first need to add the user mary, so it's an IMAP recognised user, and create an IMAP folder for her" Can anyone give me a … [View More]

2 1

[Dovecot] [gentoo-announce] [ GLSA 200803-25 ] Dovecot: Multiple vulnerabilities
by Robert Buchholz 18 Mar '08

18 Mar '08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200803-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Dovecot: Multiple vulnerabilities Date: March 18, 2008 Bugs: #212336, #213030 ID: … [View More]200803-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Two vulnerabilities in Dovecot allow for information disclosure and argument injection. Background ========== Dovecot is a lightweight, fast and easy to configure IMAP and POP3 mail server. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/dovecot < 1.0.13-r1 >= 1.0.13-r1 Description =========== Dovecot uses the group configured via the "mail_extra_groups" setting, which should be used to create lockfiles in the /var/mail directory, when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape TAB characters in passwords when saving them, which might allow for argument injection in blocking passdbs such as MySQL, PAM or shadow (CVE-2008-1218). Impact ====== Remote attackers can exploit the first vulnerability to disclose sensitive data, such as the mail of other users, or modify files or directories that are writable by group via a symlink attack. Please note that the "mail_extra_groups" setting is set to the "mail" group by default when the "mbox" USE flag is enabled. The second vulnerability can be abused to inject arguments for internal fields. No exploitation vectors are known for this vulnerability that affect previously stable versions of Dovecot in Gentoo. Workaround ========== There is no known workaround at this time. Resolution ========== All Dovecot users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.13-r1" This version removes the "mail_extra_groups" option and introduces a "mail_privileged_group" setting which is handled safely. References ========== [ 1 ] CVE-2008-1199 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1199 [ 2 ] CVE-2008-1218 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1218 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200803-25.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security(a)gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 [View Less]

1 0

[Dovecot] A tail of joy...
by Curtis Maloney 18 Mar '08

18 Mar '08

So, I _finally_ got the time to upgrade from 0.99.14 ... which I told myself I'd upgrade from once 1.0 was released... (yep, I've been _that_ busy :) So I read the Wiki page on 0.99->1.0 transition, and went through the config file - for all of about 5 or 10 minutes. I logged in at 11pm when nobody else should be using it, restarted dovecot with the new version, and logged in. Snap snap snap went my folders opening.. wow, so fast! And as I got into work this morning... nobody knew a … [View More]

2 2

[Dovecot] Can the LDA deliver email marked as read?
by Kyle Wheeler 18 Mar '08

18 Mar '08

Hello, One of my users wants to be able to deliver email (e.g. via a procmail script) and mark it *read* when it's delivered. We use Maildir as our mail storage format. I have a bit of a hack script put together that will do it by directly manipulating the Maildir (it delivers the email using safecat, and then renames the file into the "cur" directory with the necessary flags appended to the file name), but this is a hack at best, and has the problem that if Dovecot is monitoring the … [View More]

2 1

[Dovecot] How LDA deliver mail
by alex_dovecot 17 Mar '08

17 Mar '08

hi,all I read some part of the source code for studying and interesting. But i face trouble when I read the 'deliver.c'. In file 'deliver.c' on line 812 , there is a function named 'deliver_mail', see below: deliver_mail(storage, mail, destination, mailbox) I couldn't find out where is this function defined and how it was linked. Thank u for your help.

2 1

[Dovecot] current quota in mysql issue
by stefan＠webetc.de 16 Mar '08

16 Mar '08

hi all, i have a problem with storing the current quota in mysql. the configuration of the dictionary quota mostly looks like the example from the wiki. the dirsize quota limit is read correctly from the user_query, but nothing stored with quotadict in the quota table. i wonder that there is nothing like a "dict" in the logfile. did i configured anything wrong? regars stefan logfile from a imap login: Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): Effective uid=150, gid=8 Mar 15 14:… [View More]12:18 mx01 dovecot: IMAP(me(a)mydomain.de): Loading modules from directory: /usr/lib/dovecot/modules/imap Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): Module loaded: /usr/lib/dovecot/modules/imap/lib01_quota_plugin.so Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): Module loaded: /usr/lib/dovecot/modules/imap/lib02_imap_quota_plugin.so Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): Namespace: type=private, prefix=, sep=/, inbox=yes, hidden=no, subscriptions=no Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): maildir: data=/var/vmail/mydomain.de/me/Maildir Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): maildir: root=/var/vmail/mydomain.de/me/Maildir, index=/var/vmail/mydomain.de/me/Maildir, control=, inbox= Mar 15 14:12:18 mx01 dovecot: IMAP(me(a)mydomain.de): dirsize quota limit = 20000000kB Mar 15 14:12:18 mx01 dovecot: imap-login: Login: user=<me(a)mydomain.de>, method=PLAIN, rip=10.1.1.147, lip=10.1.1.146 here is my current config: package from debian etch (1.0.rc15) ### # file dovecot.conf disable_plaintext_auth = no base_dir = /var/run/dovecot/ protocols = imap imaps pop3 pop3s protocol imap { listen = mx01.int.example.net:143 ssl_listen = mx01.int.example.net:993 } protocol pop3 { listen = mx01.int.example.net:110 ssl_listen = mx01.int.example.net:995 } log_timestamp = .%Y-%m-%d %H:%M:%S . syslog_facility = mail ssl_cert_file = /etc/ssl/example.net/mailserver/mail-cert.pem ssl_key_file = /etc/ssl/example.net/mailserver/mail-key.pem ssl_ca_file = /etc/ssl/example.net/mailserver/ca.pem ssl_parameters_regenerate = 168 verbose_ssl = no mail_extra_groups = mail mail_debug = yes auth_verbose = no auth_debug = no auth_debug_passwords = no first_valid_uid = 150 last_valid_uid = 150 first_valid_gid = 8 last_valid_gid = 8 maildir_copy_with_hardlinks = yes protocol imap { login_executable = /usr/lib/dovecot/imap-login mail_executable = /usr/lib/dovecot/imap imap_client_workarounds = outlook-idle imap_max_line_length = 65536 mail_plugins = quota imap_quota } protocol pop3 { login_executable = /usr/lib/dovecot/pop3-login mail_executable = /usr/lib/dovecot/pop3 mail_plugins = quota } protocol lda { postmaster_address = postmaster(a)mydomain.com sendmail_path = /usr/lib/sendmail auth_socket_path = /var/run/dovecot/auth-master mail_plugins = cmusieve quota } auth_username_translation = %Lu auth default { mechanisms = plain passdb sql { args = /etc/dovecot/dovecot-sql.conf } userdb sql { args = /etc/dovecot/dovecot-sql.conf } user = nobody socket listen { master { path = /var/run/dovecot/auth-master mode = 0660 user = vmail group = mail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } namespace private { separator = / prefix = inbox = yes } plugin { quota = dict::: proxy::quotadict } dict { quotadict = mysql:/etc/dovecot/dovecot-sql-quota-dict.conf } ### # file dovecot-sql.conf driver = mysql connect = host=mx01.int.example.net dbname=db_mail user=dovecot password=******** default_pass_scheme = PLAIN user_query = select concat('/var/vmail/%d/%n/Maildir') as home, concat('maildir:/var/vmail/%d/%n/Maildir') as mail, 150 as uid, 8 as gid, quota from qry_dovecot where user = '%u' password_query = select user, password, concat('/var/vmail/%d/%n') as userdb_home, concat('maildir:/var/vmail/%d/%n') as userdb_mail, 150 as userdb_uid, 8 as userdb_gid from qry_dovecot where user = '%u' ### # file dovecot-sql-quota-dict.conf connect = host=db01.int.example.net dbname=db_mail user=quota password==******** table = quota select_field = current where_field = path username_field = username (don't wonder about the different database hosts. mx01 is a readonly slave from db01) [View Less]

1 1

[Dovecot] CONDSTORE + QRESYNC extensions
by Timo Sirainen 16 Mar '08

16 Mar '08

I wrote a mostly-working CONDSTORE support for Dovecot today. You can try it with: hg clone http://hg.dovecot.org/dovecot-condstore/ There are a few problems left: - STORE FLAGS.SILENT should be sending FETCH MODSEQ updates - When SELECTing a mailbox while CONDSTORE hasn't yet been enabled in the session, Dovecot returns a higher HIGHESTMODSEQ than what's used after CONDSTORE is enabled. This is because modseqs aren't tracked until client has told us that it wants them. So Dovecot doesn't … [View More]

2 3

[Dovecot] Virtual mailboxes
by Timo Sirainen 15 Mar '08

15 Mar '08

Virtual mailbox support can be tested with: hg clone http://hg.dovecot.org/dovecot-virtualboxes/ The code is still pretty non-optimized and I've only done some small tests, but at least it appears to work. Messages can't yet saved to virtual mailboxes, but I was thinking that the first configured mailbox could be used as the save destination. Configuration goes like: mail_plugins = virtual namespace private { .. prefix = virtual/ location = virtual:~/virtual-boxes } ~/virtual-boxes … [View More]

5 6

[Dovecot] Thanks to all who responded on Blackberry & IMAP
by Stewart Dean 14 Mar '08

14 Mar '08

Many good suggestions and comments. But while I was trying to do it right (silly me), the brass hat got it working with whatever is on the phone and I am told that everything is fine (until it isn't). Thanks to all who responded -- ==== Stewart Dean, Unix System Admin, Henderson Computer Resources Center of Bard College, Annandale-on-Hudson, New York 12504 sdean(a)bard.edu voice: 845-758-7475, fax: 845-758-7035

1 0