May 2018 - dovecot - dovecot.org

Dovecot blacklist?
by Marc Perkel 21 May '18

21 May '18

Just wondering if there is an easy way to have dovecot do a blacklist lookup as a negative authentication so that if the IP is on a blacklist then authentification fails even if they get the password right. If this works I have a blacklist everyone can use.

2 3

SSL error after upgrading to 2.31
by Marc Perkel 21 May '18

21 May '18

After upgrading to 2.31 I'm getting this error. Not sure what I'm doing wrong. No (No signatures could be verified because the chain contains only one certificate and it is not self signed.) ssl = yes ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt local mail.ctyme.com { protocol imap { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } } local mail.junkemailfilter.com { protocol imap { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } }

2 1

install dovecot 2.2.35 debian jessie
by Webert de Souza Lima 21 May '18

21 May '18

Hi, I can't figure how to install latest stable dovecot version 2.2.35 in Debian Jessie If I follow this guide <https://repo.dovecot.org/>, it ends up installing 2.3 If I follow this guide <https://wiki.dovecot.org/PrebuiltBinaries#preview>, it ends up installing either 2.2.13 if I use "stable" or 2.2.36 alpha if I use "jessie" I see that 2.2.35 seems to be missing here too: http://xi.dovecot.fi/debian/pool/jessie-auto/dovecot-2.2/ Thanks. Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

3 7

Dovecot fts script with solr
by André Rodier 21 May '18

21 May '18

Hello again, I have created a parser script, a little bit more advanced than the one provided with Dovecot. The main feature is probably to index documents inside zip/rar/tgz archives... I am using Ansible, swaks and doveadm to run automatic tests for each supported content. For specific reasons, I am not yet able to add Apache Tika to the distribution. However, I already made some tests with it. For now, I want to talk about the indexing script. I also have noticed a few weird behaviours. I will mention them at the end, albeit I am not 100% sure where they are coming from. I realised last week that using QEMU snapshots was not working as expected, so I am now more careful with this feature. For the developers or users who would be interested and the Dovecot team members to understand my questions, here how the tests are working: To run my tests, I have a set of files in various formats, with a UUID inside. They are office files, text files, or even archives with a text file inside... The first test I am running is the script alone. I check that the script can convert the file to text, and then I use grep to check the UUID is present. This works *perfectly* for all the content, except ppt, but it's minor. The second test is full: - I use swaks to send the email with an attachment and the appropriate mime type. - I then refresh the index using doveadm rescan. - I check that fts search returns a line, with doveadm fts search. - I then expunge the mailbox to be sure that the next test is valid. For the second test, it works almost all the time, except in the following situations: - When the attachment is an email (mime type message/rfc822) - RTF (could be a bug in my script) - Text file in UTF16 (Even if this file is converted to UTF8) *Questions:* 1 - Is there any limitation or special case for the mime message/rfc822 2 - Is the mime type received coming from the email headers? 3 - When the script is called without arguments, what is the purpose of the extension at the end of each supported mime types? 4 - Can I return a wildcard in the supported mime types, for instance "text/* *" ? 5 - I would like to handle attachments of types application/octet-stream. I have added "application/octet-stream *", but I am not sure if dovecot will pass the attachments with these mime type or not. *Notes:* 1 - I used netcat to monitor the solr server. I realise that sometimes, the data sent to the solr server only contains the headers of the email, not the text returned by the parser. Especially with rfc822 messages. I will do more tests. 2 - I just finished to write the script, it's not yet refactored, but at list it is well documented. I will do a full security audit later. I am actually testing an associated AppArmor profile. 3 - I will do more intensive test on the script on bigger mail boxes with more attachments. 4 - I may rewrite the script in Python 5 - Suggestions welcome. I initially attached the current version of the script, but the email is probably pending for review...In this case, the last development version is on Github: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/do… The configuration of supported mime types is a simple file, accessible on github as well: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/do… Thanks for your advices or suggestions.

2 1

Re: Best mail encryption solution for per-user
by Aki Tuomi 20 May '18

20 May '18

> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: > > > May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: > >> > >> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: > >> > >> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: > >> > >> Hi Tai74 and Aki, > >> I followed your conversation with interest on how to setup per user encryption in dovecot. > >> I have setup my dovecot with the following in a conf file: > >> > >> ============== > >> > >> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >> mail_plugins = $mail_plugins mail_crypt > >> plugin { > >> > >> mail_crypt_curve = secp521r1 > >> > >> mail_crypt_save_version = 2 > >> > >> } > >> > >> ============== > >> > >> This works nice, all emails are being encrypted and every user/folder has keys. > >> But as I understood from your conversation these keys are not protected. And I want them to be > >> protected by the users password used by imap. > >> > >> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up > >> the DB and postfix/dovecot) > >> > >> but how would i set it so, that the users password from the DB is used to encrypt the keys? > >> > >> should i use mail_crypt_private_password = ? > >> how do i point it to the mysql db then? > >> im unsure about this > >> > >> Do you have any hints on this? > >> > >> Kind regards, > >> Zjemm > >> > >> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your > >> user's keys using user's login password, you must have a TOOL that manages this. > >> > >> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >> a good option. > >> > >> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time > >> user changes his password. > >> > >> Also note that if you go down this road, and the user forgets his password, you will not be able to > >> recover the emails without backup copy of the private key. > >> > >> Aki > >> > >> Hi Aki > >> > >> I used the following command: > >> dovecot pw -s SHA256-CRYPT > >> > >> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ > >> > >> This output is used to store in the password fields in the database. So no plain text passwords no > >> :) > >> > >> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >> password as private password. > >> > >> can you explain this a bit more for me? > >> > >> for now i have in the 10-auth.conf file the following: > >> ============== > >> passdb { > >> driver = sql > >> > >> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext > >> args = /etc/dovecot/dovecot-sql.conf.ext > >> } > >> > >> and: > >> > >> userdb { > >> driver = static > >> args = uid=vmail gid=vmail home=/var/vmail/%d/%n > >> } > >> ============== > >> > >> then i have in dovecot-sql.conf.ext > >> ============== > >> driver = mysql > >> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample > >> default_pass_scheme = SHA256-CRYPT > >> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; > >> ============== > >> Where do i need to set : mail_crypt_private_password = %w ? > >> > >> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >> a good option. > >> > >> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. > >> so this step isnt nesesary anymore am i right? > >> > >> Thank you for your quick response, very helpfull > >> > >> Zjemm > >> > >> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the > >> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed > >> password is.. > >> > >> So: > >> > >> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >> virtual_users WHERE email='%u' > >> > >> Aki > >> > >> Hi Aki, > >> > >> Thank you very much for your help, i realy appreciate that. > >> > >> Ok so if i understand it correctly i'll have to use: > >> > >> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >> virtual_users WHERE email='%u' > >> > >> in my dovecot-sql.conf.ext file > >> > >> This query selects the user, the password, and %w > >> > >> if i run a little query myself: > >> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password > >> FROM virtual_users; > >> +------------------+----------------------------------+------------------------------------+ > >> | user | password | userdb_mail_crypt_private_password | > >> +------------------+----------------------------------+------------------------------------+ > >> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | > >> +------------------+----------------------------------+------------------------------------+ > >> > >> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as > >> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that > >> is typing in the password when authenticating. > >> > >> is this correct? > > > > yes. > > > >> so then i have the username the hashed password en the plaintext password as a result of the query. > > > > yes > > > >> now userdb_mail_crypt_private_password = the plaintext password > >> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by > >> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? > > > > It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin > > {} section. > > > >> if i have this setup working i'm going to write a blog post on this topic to share this knowledge > >> > >> Thanks again and have a great weekend. > >> > >> Zjemm > > > > Aki > > Hi Aki, > > Cool i'm testing it right now. > I have set up a new mailserver (life is great with lxc containers :) ) > > postfix and dovecot are working like normal > > next i enable mail_crypt > > i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf > ========================== > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > > mail_plugins = $mail_plugins mail_crypt > > plugin { > mail_crypt_curve = secp521r1 > mail_crypt_save_version = 2 > } > ========================== > > and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext > > so the query is now the new query: > password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE email='%u'; > > then i restarted dovecot and postfix and send a test email to the one and only testuser that is in there. > > when i open the mailbox with the tool mutt, i can see the new email, and when openening the email the mutt client drops the connection. > > in the log i can see: > > May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> > May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() failed: read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser… failed: Private key not available: Cannot decrypt key bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) > > > i think i missed a step, but witch one? > > the userpassword hasnt been changed (that would be the next step in the testing process) > > should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that on the fly, because the initial keys where only just created when enabling the mail_crypt plugin > > please let me know your thougts > Zjemm I noticed you replied directly to me, and not to the list, too... fixed that for you. mail_crypt_private_password is used when key is created, but if you have created it before using password, you'll need to encrypt it before turning the setting on. Aki

1 0

Disconnecting unauthenticated IMAP entities faster?
by David Hubbard 20 May '18

20 May '18

Hello, given the 2015 revision date, I was curious if anyone can confirm https://wiki2.dovecot.org/Timeouts is still accurate where the 'before login' IMAP timeout remains hard coded? We're having an issue where blocks of IP's from China and similar locations are crawling IP ranges trying common login credentials, and hanging the connections open in the process. We have clients who have large numbers of employees at single locations, so it isn't possible to reduce the mail_max_userip_connections (assuming it even applies to pre-auth sessions) to a low value. The end result is these connections chew up all the imap-login processes because they sit there until the three-minute timeout is hit, blocking legit users. The only workaround is to raise both the imap and imap-login processes to a massive amount to support all the pre-auth hung open connections. It would be a lot easier to find a reasonable process limit if we could boot these unauthenticated connections off in a more reasonable amount of time, like 5-10 seconds, but I'm not seeing a way to accomplish that? Thanks

3 2

indexer-worker issues on dovecot 2.3.0
by Ricardo Machini Barbosa 18 May '18

18 May '18

Hello, I have some mailbox with error on index-worker process on dovecot 2.3.0 If I move the same mailbox to dovecot 2.2.33.2 this problem dos not happen. See below the backtrace: May 18 10:33:55 Error: imap(xxxxx)<249924><Xpj77npscpYKAQMQ>: indexer failed to index mailbox INBOX May 18 10:33:55 Fatal: indexer-worker(xxxxx)<281701><Xpj77npscpYKAQMQ:UK9sNELW/lplTAQAF3haWw>: master: service(indexer-worker): child 281701 killed with signal 6 (core dumps disabled) May 18 10:34:55 Panic: indexer-worker(xxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: file unichar.c: line 160 (uni_ucs4_to_utf8_c): assertion failed: (uni_is_valid_ucs4(chr)) May 18 10:34:55 Error: indexer-worker(xxxxxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xc9804) [0x7f157c8eb804] -> /usr/lib64/dovecot/libdovecot.so.0(+0xc98be) [0x7f157c8eb8be] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f157c85e34b] -> /usr/lib64/dovecot/libdovecot.so.0(uni_ucs4_to_utf8_c+0xc0) [0x7f157c9220b0] -> /usr/lib64/dovecot/libdovecot.so.0(+0xaadc9) [0x7f157c8ccdc9] -> /usr/lib64/dovecot/libdovecot.so.0(mail_html2text_more+0xc5) [0x7f157c8ccf85] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc563) [0x7f157be14563] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_parser_more+0x27) [0x7f157be14307] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x440) [0x7f157be121a0] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10266) [0x7f157be18266] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7f157cbd56ae] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](+0x2794) [0x55bff457f794] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f157c902df5] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f) [0x7f157c90469f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x52) [0x7f157c902ef2] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f157c903118] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f157c880ce3] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](main+0xdb) [0x55bff457f18b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f157c480c05] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](+0x2252) [0x55bff457f252] May 18 10:34:55 Error: indexer: Indexer worker disconnected, discarding 1 requests for xxxxxx May 18 10:34:55 Error: imap(xxxxx)<249924><Xpj77npscpYKAQMQ>: indexer failed to index mailbox INBOX May 18 10:34:55 Fatal: indexer-worker(xxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: master: service(indexer-worker): child 307016 killed with signal 6 (core dumps disabled) uname -a Linux mailsrv01 2.6.32-696.23.1.el6.x86_64 #1 SMP Tue Mar 13 22:44:18 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux dovecot --version 2.3.0.1 (ffd8a29) dovecot -n # 2.3.0.1 (ffd8a29): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (61b47828) # OS: Linux 2.6.32-696.23.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) # Hostname: mailsrv01 auth_master_user_separator = * auth_verbose_passwords = sha1 default_client_limit = 2000 deliver_log_format = subject=%s from:%f sender:%e to: %{to_envelope} size:%p msgid=%m status=%$ delivery_time=%{delivery_time} session_time=%{session_time} disable_plaintext_auth = no doveadm_allowed_commands = quota get,dsync-server,kick,purge,fts rescan,altmove,mailbox list,expunge,mailbox status doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes login_greeting = IMAP4. login_trusted_networks = x.x.x.x/24 mail_fsync = never mail_gid = xxx mail_location = mdbox:~/mdbox:ALT=/altstorage%h/mdbox mail_plugins = quota quota_clone fts fts_solr zlib mail_uid = xxx managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate vnd.dovecot .filter namespace inbox { inbox = yes list = yes location = mailbox "Itens Enviados" { auto = subscribe special_use = \Sent } mailbox "Itens Excluídos" { auto = subscribe special_use = \Trash } mailbox Rascunhos { auto = subscribe special_use = \Drafts } mailbox Spam { auto = subscribe special_use = \Junk } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_solr = url=http://x.x.x.x:8983/solr/dovecot/ imapsieve_mailbox1_before = file:/etc/dovecot/antispam/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/etc/dovecot/antispam/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = redis:host=x.x.x.x:port=6379 quota = count:User quota quota_clone_dict = redis:host=x.x.x.x:port=6379 quota_rule = *:bytes=0 quota_rule2 = Itens Excluídos:storage=+xM quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/audit.sieve sieve_before2 = /etc/dovecot/sieve/duplicate.sieve sieve_before3 = /etc/dovecot/sieve/spam.sieve sieve_dir = ~/sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/antispam sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } protocols = imap pop3 lmtp sieve service anvil { client_limit = 2000 } service auth { client_limit = 2000 } service doveadm { inet_listener { port = 9011 } inet_listener http { port = 9010 } vsz_limit = 768 M } service imap-login { process_limit = 800 process_min_avail = 200 service_count = 1 vsz_limit = 512 M } service imap-postlogin { executable = script-login dovecot-postlogin imap unix_listener imap-postlogin { user = mail } user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 20000 vsz_limit = 768 M } service indexer-worker { vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = * port = 24 } vsz_limit = 512 M } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 10 } service managesieve { process_limit = 512 } service pop3-postlogin { executable = script-login dovecot-postlogin pop3 unix_listener pop3-postlogin { user = mail } user = $default_internal_user } service pop3 { executable = pop3 pop3-postlogin } service quota-warning { executable = script quota-warning unix_listener quota-warning { user = mail } } service stats { chroot = empty client_limit = 20000 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ssl = no submission_host = x.x.x.x userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lda { mail_fsync = optimized mail_plugins = quota quota_clone sieve } protocol imap { imap_max_line_length = 128 k mail_max_userip_connections = 30 mail_plugins = quota quota_clone fts fts_solr zlib imap_quota last_login imap_sieve } protocol lmtp { mail_fsync = optimized mail_plugins = quota quota_clone sieve } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = quota quota_clone fts fts_solr zlib last_login pop3_logout_format = in=%i out=%o top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = yes pop3_save_uidl = yes pop3_uidl_format = %08Xu%08Xv } Regards, Ricardo

2 1

vacation stumbles over invalid headers
by Militades Sunfire 18 May '18

18 May '18

# 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.10 the vacation feature stumbles over invalid headers in several cases, causing an even more invalid header f.ex. if the original mail contains a line with only spaces in the vacation reply the header breaks apart displying not only the inteded vacation message but also parts of the message header. depends a bit on the client what happends of course, thunderbird and the mac client are two examples. Greetings

1 0

Decryption method for Maildir messages stored by mail_crypt plugin
by Ben Harrison 17 May '18

17 May '18

I've successfully implemented the mail_crypt plugin on v2.2.27 and it's working like a champ, but some of our administrative operations require access to Maildir messages in plaintext. I've found numerous threads detailing help with mail_crypt setup, but none of my research has yielded a method of decrypting the stored messages. Relevant plugin config: mail_crypt_curve = prime256v1 mail_crypt_global_private_key = <pirvkey> mail_crypt_global_public_key = <pubkey> mail_crypt_save_version = 2 Method I attempted for manual decryption is listed below: openssl pkeyutl -derive -inkey mailcrypt.key -peerkey mailcrypt.pub -out shared_secret.bin openssl enc -aes256 -base64 -k $(base64 shared_secret.bin) -d -in test.enc -out test.txt Openssl reports an error reading the input file, but it isn't permissions related. I started looking for the encryption/decryption method in the source but figure it's worth seeing if there's some existing methodology I can employ here. Appreciate any feedback. Thanks, -- -- -- *Ben Harrison* *BHarrison.IT*843.492.4870

2 1

External Program for Authentication?
by Marc Perkel 17 May '18

17 May '18

Is it possible to run a bash script for authentication where a 0 exit code indicates success and a non-zero is failure? What I'm trying to do is create a shadow IMAP server that authenticates against a different server. That way my server will use the same passwords as an existing server. So what I would need is for dovecot to pass the username and password to my script, I attempt to log in remotely and if I succeed I allow access on my side. My side will be used to configure black lists and where spam is dragged from their side to my side. (I'm a spam filtering company)

4 3