September 2020 - dovecot

dovecot TSL 1.3 config option 'ssl_ciphersuites' causes fatal error on launch. not supported, bad config, or bug?
by PGNet Dev 24 Sep '20

24 Sep '20

I've installed grep PRETTY /etc/os-release PRETTY_NAME="Fedora 32 (Server Edition)" dovecot --version 2.3.10.1 (a3d0e1171) openssl version OpenSSL 1.1.1g FIPS 21 Apr 2020 iiuc, Dovecot has apparently had support for setting TLS 1.3 ciphersuites since v2.3.9, per this commit lib-ssl-iostream: Support TLSv1.3 ciphersuites https://github.com/dovecot/core/commit/8f6f04eb21276f28b81695dd0d3df57c7b8f… checking openssl rpm -ql openssl-devel-1.1.1g-1.fc32.x86_64 | grep -i ciphersuites /usr/share/man/man3/SSL_CTX_set_ciphersuites.3ssl.gz /usr/share/man/man3/SSL_set_ciphersuites.3ssl.gz man SSL_set_ciphersuites ... SSL_set_cipher_list() sets the list of ciphers (TLSv1.2 and below) only for ssl. SSL_CTX_set_ciphersuites() is used to configure the available TLSv1.3 ciphersuites for ctx. This is a simple colon (":") separated list of TLSv1.3 ciphersuite names in order of preference. Valid TLSv1.3 ciphersuite names are: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 An empty list is permissible. The default value for the this setting is: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" SSL_set_ciphersuites() is the same as SSL_CTX_set_ciphersuites() except it configures the ciphersuites for ssl. ... checkin in dovecot tag 2.3.10.1's src, m4/ssl.m4 (m4) ... AC_CHECK_LIB(ssl, SSL_CTX_set_ciphersuites, [ AC_DEFINE(HAVE_SSL_CTX_SET_CIPHERSUITES,, [Build with SSL_CTX_set_ciphersuites() support]) ],, $SSL_LIBS) ... and, src/lib-ssl-iostream/iostream-openssl.c ... #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES if (set->ciphersuites != NULL && strcmp(ctx_set->ciphersuites, set->ciphersuites) != 0) { if (SSL_set_ciphersuitesl(ssl_io->ssl, set->ciphersuites) == 0) { *error_r = t_strdup_printf( "Can't set ciphersuites to '%s': %s", set->ciphersuites, openssl_iostream_error()); return -1; } } #endif ... suggests that ciphersuite support exists. bug, checking in ./src/lib-master/master-service-ssl.c ... void master_service_ssl_ctx_init(struct master_service *service) { const struct master_service_ssl_settings *set; struct ssl_iostream_settings ssl_set; const char *error; if (service->ssl_ctx_initialized) return; service->ssl_ctx_initialized = TRUE; /* must be called after master_service_init_finish() so that if initialization fails we can close the SSL listeners */ i_assert(service->listeners != NULL || service->socket_count == 0); set = master_service_ssl_settings_get(service); if (strcmp(set->ssl, "no") == 0) { /* SSL disabled, don't use it */ return; } i_zero(&ssl_set); ssl_set.min_protocol = set->ssl_min_protocol; ssl_set.cipher_list = set->ssl_cipher_list; ssl_set.curve_list = set->ssl_curve_list; ssl_set.ca = set->ssl_ca; ... there's only mention of set->ssl_cipher_list , not set->ssl_ciphersuites or equivalent, afaict. if in dovecot's 10-ssl.conf I set ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 + ssl_ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 on restart journalctl -f -u dovecot -- Logs begin at Sun 2020-09-20 14:30:30 PDT. -- Sep 23 18:28:42 mx.example.com dovecot[4269]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 92: Unknown setting: ssl_ciphersuites _is_ setting TLS 1.3 ssl_ciphersuites = in fact currently supported, and usage is wrong here^?

3 3

Importing Mail
by Odhiambo Washington 24 Sep '20

24 Sep '20

Hi good people, I have an old server that holds old mail (mdbox) and a new server that also uses mdbox. I'd like to import the old mail from the old server into the live/new server. The imported mail should not be treated as new mail for the existing mail accounts. What is the best way to achieve this? Lastly, is there a way to convert mdbox to Maildir? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 2

Vacation sieve explained: how does it work?
by Graham Leggett 24 Sep '20

24 Sep '20

Hi all, I have a legacy system that uses gnarwl to handle vacation messages, most specifically the vacation messages are stored in LDAP. We have a web based tool that allows people to update their vacation message, all they’re doing is modifying LDAP. I am trying to find out if dovecot’s vacation sieve can do the same thing. I am struggling however to find something that describes to me how dovecot vacation sieve is configured. Is there a howto or walkthrough anywhere? Specific burning questions: - If I was to configure the dovecot vacation sieve, where is the body of each vacation message stored? File on disk? In a store like an LDAP store? Somewhere else? - How is the body of vacation message modified? Does this happen through the IMAP protocol, a command line tool, something else? - How is the vacation message switched on and off? Does this happen through the IMAP protocol, a command line tool, or something else? The docs at https://wiki2.dovecot.org/Pigeonhole/Sieve/Extensions/Vacation describe how to control how often the vacation messages are sent, but very little else. I am very confused :( Regards, Graham —

4 8

BUG: _presence_ of valid openssl.cnf Option = 'ServerPreference' causes Dovecot submission relay FAIL: "failed: Failed to initialize SSL: ..."
by PGNet Dev 24 Sep '20

24 Sep '20

I've dovecot --version 2.3.10.1 (a3d0e1171) openssl version OpenSSL 1.1.1g FIPS 21 Apr 2020 , atm on Fedora32. I configure /etc/pki/tls/openssl.cnf to set preferences for apps' usage, e.g. Postfix etc; Typically, here cat /etc/pki/tls/openssl.cnf openssl_conf = default_conf [default_conf] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] MinProtocol = TLSv1.2 Ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 CipherString = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 Options = PrioritizeChaCha,ServerPreference However, any/all sends from local client via Dovecot submission -- from an instance on the same server -- FAILS with that^^ openssl.cnf, ==> /var/log/dovecot/dovecot.log <== ... 2020-08-24 17:04:42 submission(testuser(a)example.com)<D4c5c6itUg2sHgsH>: Error: smtp-client: conn int.mx.example.net:465 (10.0.4.65:465) [1]: connect(int.mx.example.net:465) failed: Failed to initialize SSL: Couldn't initialize SSL context: Can't load SSL certificate: error:14187180:SSL routines:ssl_do_config:bad value: section=system_default, cmd=Options, arg=ServerPreference,PrioritizeChaCha 2020-08-24 17:04:42 submission(testuser(a)example.com)<D4c5c6itUg2sHgsH>: Error: Failed to establish relay connection: Failed to connect to remote server ... editing, - Options = PrioritizeChaCha,ServerPreference + Options = PrioritizeChaCha cures the error ==> /var/log/dovecot/dovecot.log <== ... 2020-08-24 17:08:04 submission(testuser(a)example.com)<Uow+f6itZg2sHgsH>: Info: Successfully relayed message: from=<testuser(a)example.com>, size=433, id=Mh4pJWRWRF9jHQAAVDn7pA, nrcpt=1, reply=`250 2.0.0 Ok: queued as 4Bb8TJ4VQbz7v6t' ... checking ssl docs https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html BOTH are valid 'Options', ... ServerPreference: use server and not client preference order when determining which cipher suite, signature algorithm or elliptic curve to use for an incoming connection. Equivalent to SSL_OP_CIPHER_SERVER_PREFERENCE. Only used by servers. PrioritizeChaCha: prioritizes ChaCha ciphers when the client has a ChaCha20 cipher at the top of its preference list. This usually indicates a mobile client is in use. Equivalent to SSL_OP_PRIORITIZE_CHACHA. Only used by servers. ... The mere presence of that option in a system-wide openssl.cnf shouldn't cause a Dovecot submission failure.

2 7

At a loss with antispan and imap_sieve
by Ferenc 24 Sep '20

24 Sep '20

Hi, It seems I can’t google my way out of this one. I’m trying to set up spam/ham learning but getting nowhere. I tried Johannes Berg Antispam plugin, and syslog shows: Sep 20 22:22:06 proefmail imap: antispam: running mailtrain backend program /usr/lib/dovecot/retrain.sh Sep 20 22:22:06 proefmail imap: antispam: running mailtrain backend program /usr/lib/dovecot/retrain.sh Sep 20 22:22:06 proefmail imap: antispam: running mailtrain backend program parameter 1 /mail/klaas Sep 20 22:22:06 proefmail imap: antispam: running mailtrain backend program parameter 2 ham The file retrain.sh is simply: #!/bin/sh echo hi >> debug.log ...with debug.log being an empty world-writeable file in /usr/lib/dovecot. Absolutely nothing happens. The file debug.log is not even touched. But when I remove retrain.sh there’s an error logged so up until then, *something* happens. After this I tried imap_sieve, following the wiki on dovecot.org, but again nothing happens. My imap.log says: Info: sieve: pipe action: piped message to program `retrain.sh’ But again debug.log is untouched. I’m fresh out of ideas here. Any help would be most welcome. I’m on Debian in virtual machine, Postfix delivering mail to Dovecot LMTP delivering to virtual maildirs, bogofilter for scanning incoming mail. Sieve does work for moving incoming spam to the spam mailbox. Cheers and thanks, Ferenc

3 6

implementing folder hashing
by Adrian Minta 23 Sep '20

23 Sep '20

Hi everyone, I want to ask if any of you has done a migration from a single storage to multiple back-end storages and what is the best strategy for folder hashing that you use. Using something like %H or %M how do you predict where the mail will end up in order to move the existing folders ? Thank you ! -- Best regards, Adrian Minta

2 4

Dovecot SASL
by Jorge Bastos 22 Sep '20

22 Sep '20

Howdy, I know i've asked this before, but i think i got really no answer. I'd like to have dovecot SASL, to check AUTH against an SQL table, instead of dovecot SASL use the AUTH MECH for imap/pop3. I want this, to have the same behavior as I have now, where i use postfix with cyrus SASL on a different table (with the same login details), and when i have an user that his accounts was hacked for sending spam, i just block the send and allow the user to keep receiving emails, for example to warn him. Would this be possible? Dovecot SASL against a SQL table? Havent found much info about it, Thanks in advanced,

2 2

Re: Leaked Events
by bobby 22 Sep '20

22 Sep '20

Is this an affected version of the bug? > 2.3.8 (9df20d2db) > > On Tue, Sep 8, 2020 at 12:42 PM Stephan Bosch <stephan(a)rename-it.nl> > wrote: > >> >> >> On 08/09/2020 18:01, bobby wrote: >> > I am going through my maillog file, and noticed these events: >> > >> > Sep 8 15:56:17 mail dovecot[294462]: lmtp(391257): Warning: Event >> > 0x55db5bc41200 leaked (parent=0x55db5bc3b830): >> mail-storage-service.c:1325 >> > Sep 8 15:56:17 mail dovecot[294462]: lmtp(391257): Warning: Event >> > 0x55db5bc3b830 leaked (parent=0x55db5bc34450): >> smtp-server-recipient.c:38 >> > Sep 8 15:56:17 mail dovecot[294462]: lmtp(391257): Warning: Event >> > 0x55db5bc34450 leaked (parent=0x55db5bc34130): connection.c:523 >> > Sep 8 15:56:17 mail dovecot[294462]: lmtp(391257): Warning: Event >> > 0x55db5bc34130 leaked (parent=0x55db5bc20ce0): >> > smtp-server-connection.c:773 >> > Sep 8 15:56:17 mail dovecot[294462]: lmtp(391257): Warning: Event >> > 0x55db5bc20ce0 leaked (parent=(nil)): lmtp-client.c:164 >> > >> > Is this something to be concerned about? >> >> Usually, not. >> >> But, it is a bug. What version is this? >> >> Regards, >> >> Stephan. >> >

3 6

FTS Index based on UserDB preference
by Scott Q. 22 Sep '20

22 Sep '20

Does anyone know if it's possible to do FTS Index based on a userdb preference ? Basically if the preference is 'on' , dovecot goes ahead with the fts indexing for that particular user. I'm guessing right now it's not possible but is there anyone that could envision writing such a patch ? If so, can you contact me off-list ?

2 2

[SOLVED]AW: AW: doveadm search segfault Dovecot 2.2.22
by rudolf＠padaru.de 22 Sep '20

22 Sep '20

Dear Aki thank you! With version 2.3.11 of dovecot it works fine. Yours sincerely Pascal Rudolf -----Ursprüngliche Nachricht----- Von: dovecot <dovecot-bounces(a)dovecot.org> Im Auftrag von Aki Tuomi Gesendet: Montag, 21. September 2020 17:37 An: rudolf(a)padaru.de; Dovecot Mailing List <dovecot(a)dovecot.org> Betreff: Re: AW: doveadm search segfault Dovecot 2.2.22 > On 21/09/2020 15:14 rudolf(a)padaru.de wrote: > > > Hey, > > i am now a bit deeper into dovecot debugging with gdb and have a full bt now, with debugging infos. > > Is there a patch that resolve this Problem in dovecot 2.2.22-1ubuntu2.13 for ubuntu 16? > > Here the bt: > Hi! We don't really support 2.2.22 since it was released several years ago. Please try to reproduce this issue with 2.2.36 or 2.3.11. You can find packages for 2.3.11 from https://repo.dovecot.org Aki

1 0