February 2020 - dovecot

CVE-2020-7046: Truncated UTF-8 can be used to DoS submission-login and lmtp processes
by Aki Tuomi 12 Feb '20

12 Feb '20

Open-Xchange Security Advisory 2020-02-12 Affected product: Dovecot Core Internal reference: DOV-3744 (JIRA ID) Vulnerability type: Improper Input Validation (CWE-30) Vulnerable version: 2.3.9 Vulnerable component: submission-login, lmtp Fixed version: 2.3.9.3 Report confidence: Confirmed Solution status: Fixed Researcher credits: Open-Xchange oy Vendor notification: 2020-01-14 CVE reference: CVE-2020-7046 CVSS: 7.5 (CVSS3.1:AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: lib-smtp doesn't handle truncated command parameters properly, resulting in infinite loop taking 100% CPU for the process. This happens for LMTP (where it doesn't matter so much) and also for submission-login where unauthenticated users can trigger it. Risk: Attacker can cause submission-login and lmtp processes to be exhausted, leading into denial of service and CPU resource exhaustion. Solution: Upgrade to 2.3.9.3.

1 0

CVE-2020-7957: Specially crafted mail can crash snippet generation
by Aki Tuomi 12 Feb '20

12 Feb '20

Open-Xchange Security Advisory 2020-02-12 Affected product: Dovecot Core Internal reference: DOV-3743 (JIRA ID) Vulnerability type: Improper Input Validation (CWE-30) Vulnerable version: 2.3.9 Vulnerable component: lmtp, imap Fixed version: 2.3.9.3 Report confidence: Confirmed Solution status: Fixed Researcher credits: Open-Xchange oy Vendor notification: 2020-01-14 CVE reference: CVE-2020-7957 CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vulnerability Details: Snippet generation crashes if: message is large enough that message-parser returns multiple body blocks The first block(s) don't contain the full snippet (e.g. full of whitespace) input ends with '>' Risk: Sending specially crafted email can cause mailbox to have permanently unaccessible mail, or the mail can be stuck in delivery. Solution: Upgrade to 2.3.9.3

1 0

Folders disappears and all mail lost
by Gabriele Fain 11 Feb '20

11 Feb '20

Hello, I have a Dovecot 2.2.22 configured with mdbox storage. THe server have about 50 mailboxes configured. Only in one mailbox I have a strange problem, sometime (in the last 2 month happens 3 times). All the mail (Except INBOX) and all folders disappear. THe space on disk remain allocated. To this mailbox are connected 3 computers (2 PC Windows 10, and 1 Mac OS). I cannot determine who and why this happens to this mailbox. Can someone tellme how I can find the PC that delete all mail.

2 1

[v 2.3.4.1][quota] recalculation
by Thomas Criscione 11 Feb '20

11 Feb '20

Hello, I can't find the information on the wiki :( When is the quota recalculated after a mail deletion ? For instance, I am running low of storage and I use Thunderbird to delete large mail. I only notice a recalculation when I quit Thunderbirdb and I relaunch it. Even, with doveadm CLI, as long as Thunderbird is not disconnected on the client side, the server didn't recalculate the storage available. Thanks for the help ! Thomas -- Thomas Criscione https://thomascriscione.fr GPG: E521 FFF0 13C4 52FB 55EB 8C49 EBDD 0DC6 1ED9 2A4F

3 4

starttls for some services only
by Bjoern Jacke 10 Feb '20

10 Feb '20

Hi, I would like to disable offering starttls to clients for certain dovecot services. Background is that I want to do let a load balancer do the TLS stuff right on connect time and let dovecot only do plain imap without offering starttls (because the clients do imaps actually). Getting rid of the starttls feature offering works only if I set ssl = no globally only. Setting it in the service imap-login section seems to be impossible. If I set it globally to no though, I cannot use it in other services where it is needed like in the manage-sieve, where clients unfortunately only support starttls and no tls on connect. Is there any way to configure dovecot to offer starttls for some services and for some not or is this just not supported currently? Thanks Björn

2 4

Email Server Backup Strategy
by Esteban L 10 Feb '20

10 Feb '20

Hello, Was thinking it would be wise to backup my server, in case anything "bad" ever happened, so that I could quickly get up to speed. 1. clone the whole drive -- which might be the best to ensure I keep the whole system working. 2. But, what about, if I just wanted to backup my Email server components? Postfix - which I think is just config files, and Dovecot - I think there is a doveadm backup for doing such things. What do you guys do, recommend for backups?? Thanks -- https://www.little-beak.com "Doing what we can."

7 9

postmaster_address parameter scope
by mabi 10 Feb '20

10 Feb '20

Hello, I was wondering when I define the following dovecot parameter: postmaster_address = postmaster(a)mydomain.com in my local.conf config file, does this parameter apply globally? I mean because it is not inside any {} curly braces does it also appliy to: protocol lmtp { ... } or do I need o explicitly define again my postmaster_address parameter inside protocol lmtp{} like this? protocol lmtp { postmaster_address = postmaster(a)mydomain.com } My very same question applies also for protocol lda {}... Regards, Mabi

1 0

Reload Dovecot with thousands of domains.
by Victor 10 Feb '20

10 Feb '20

Hello!, I have a dovecot server configured with about 3k different domains. It worked without problems until SSL certificates has been installed. After increase available RAM and stabilizing the service my current problem is in renewals. Dovecot reload process consumes a lot of memory for every one certificate renewal. The server has enough memory to support reload in most cases, but if server has certain load, reload process throws down the service. I’m using lets encrypt certificates and this process is automated. Is there any way to reload just one domain/session?

1 0

How to configure mail-filter plugin
by 刘莹莹 10 Feb '20

10 Feb '20

I config mail-filter plugin like https://wiki2.dovecot.org/Plugins/MailFilter describe， but error occurred mail-filter plugin config in dovecot.conf: mail_plugins = mail_filter plugin { mail_filter = mail-filter %u # %u = username given to the script as first mail_filter_out = mail-filter-out %u } service mail-filter { executable = script /usr/local/bin/mail-filter.sh user = vmail group = vmail unix_listener mail-filter { mode = 0666 user = vmail group = vmail } } service mail-filter-out { executable = script /usr/local/bin/mail-filter-out.sh user = vmail group = vmail unix_listener mail-filter-out { mode = 0666 user = vmail group = vmail } } vim /usr/local/bin/mail-filter.sh touch /tmp/testfile cat > /tmp/tempfile cat /tmp/tempfile vim /usr/local/bin/mail-filter-out.sh cat > /tmp/tempfile cat /tmp/tempfile then "dovecot-lda -f q1(a)a.com -d q1(a)a.com < test.eml" Error log: Feb 10 10:00:21 lda(q1(a)a.com)<18794><9ZN8EzW5QF5qSQAA0J78UA>: Debug: Namespace : Using permissions from /home/a.com/q1: mode=0700 gid=default Feb 10 10:00:21 lda(q1(a)a.com)<18794><9ZN8EzW5QF5qSQAA0J78UA>: Panic: file ostream.c: line 201 (o_stream_flush): assertion failed: (stream->stream_errno != 0) Feb 10 10:00:21 lda(q1(a)a.com)<18794><9ZN8EzW5QF5qSQAA0J78UA>: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f049f4ef582] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f049f4ef68e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe4b6e) [0x7f049f4f9b6e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe4bb1) [0x7f049f4f9bb1] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f049f4565e8] -> /usr/lib64/dovecot/libdovecot.so.0(+0x10bc47) [0x7f049f520c47] -> /usr/lib64/dovecot/libdovecot-storage.so.0(dbox_save_end+0x35) [0x7f049f8262f5] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_save_finish+0x39) [0x7f049f81af99] -> /usr/lib64/dovecot/libdovecot-lda.so.0(+0x3fbe) [0x7f049fb0efbe] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_save_finish+0x73) [0x7f049f801493] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xc9) [0x7f049f7f38e9] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_copy+0x46) [0x7f049f81b816] -> /usr/lib64/dovecot/libdovecot-lda.so.0(+0x3daa) [0x7f049fb0edaa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x4e87c) [0x7f049f80187c] -> /usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver_save+0x1d7) [0x7f049fb103e7] -> /usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver+0x2fe) [0x7f049fb10bfe] -> /usr/libexec/dovecot/dovecot-lda(main+0x615) [0x55f636880045] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f049f073c05] -> /usr/libexec/dovecot/dovecot-lda(+0x3b7e) [0x55f636880b7e]

1 0

noreplicate for some users
by mail＠backprod.de 08 Feb '20

08 Feb '20

Hi, I have set up the sync and it is working but I only would like to sync some users. Currently this does not seem to work. Version 2.3.9.2 Relevant Settings: File users: mail@domain.de:{SHA}hash:::t: passdb { driver = passwd-file args = username_format=%u /etc/dovecot/users } userdb { driver = passwd-file args = username_format=%u /etc/dovecot/users default_fields = uid=2222 gid=2222 home=/var/vmail/%d/%n userdb_noreplicate=t } After restart of dovecot I allways get all users with sudo doveadm replicator status "*" usernamepriority fast sync full sync success sync failed abuse(a)domain.net none 00:01:58 03:52:23 - y admin(a)domein.net none 00:01:58 03:52:23 - y abuse(a)domein.de none 00:01:58 07:51:00 - y What value needs to be set to get replication / no replication and to remove the users from the list? I have tried 0 / 1 / True / False / t / f / T / F but I don't see a change in behavior. Best regards Tim

2 2