May 2022 - dovecot - dovecot.org

Re: dovecot Digest, Vol 229, Issue 23
by Thom Pol 18 May '22

18 May '22

I must say I was a bit sceptical if this sieve script would resolve it, but it seems like it totally did! Thanks a lot for your reply, hope this helps someone else in the future as well. Kind regards, Thom Pol On 16/05/2022 08:12, Paul Kudla (SCOM.CA Internet Services Inc.) wrote: > ok duplicsate emails (even across dsync, replication etc) is typically > handled via a global sieve script > > > I use : > > # cat duplicates.sieve > require "duplicate"; # for dovecot >= 2.2.18 > > if duplicate { > discard; > stop; > } > > for the scripts > > and setup sieve to work via my dovecot.conf file > > relative parts below : > > -------------------------------------------------------------------- > > protocols = imap pop3 lmtp sieve > > protocol lmtp { > mail_plugins = $mail_plugins sieve > postmaster_address =monitor(a)scom.ca > } > > > protocol lda { > mail_plugins = $mail_plugins sieve > } > > > plugin { > ..... > > sieve =file:~/sieve;active=~/sieve/.dovecot.sieve > > sieve_duplicate_default_period = 1h > sieve_duplicate_max_period = 1d > sieve_extensions = +duplicate +notify +imapflags +vacation-seconds > sieve_global_dir = /usr/local/etc/dovecot/sieve > sieve_before = /usr/local/etc/dovecot/sieve/duplicates.sieve > > ..... > } > > service managesieve-login { > process_limit = 1000 > vsz_limit = 1g > inet_listener sieve { > port = 4190 > } > } > > protocol sieve { > managesieve_implementation_string = Dovecot Pigeonhole > managesieve_max_line_length = 65536 > } > > > > ------------------------------------------------------------------ > > > note the sieve_before which handles duplictes during delivery etc. > > > Happy Monday !!! > Thanks - paul > > Paul Kudla > > > Scom.ca Internet Services<http://www.scom.ca> > 004-1009 Byron Street South > Whitby, Ontario - Canada > L1N 4S3 > > Toronto 416.642.7266 > Main?1.866.411.7266 > Fax?1.888.892.7266

2 1

dovecot virtual users with sendmail, my solution
by Christopher McCrory 18 May '22

18 May '22

Hello... I wanted to use dovecot virtual users with sendmail. As you probably know, this doesn't work by default. The more scalable solution is probably to use LDAP, but I really don't like it. This is how I did it https://github.com/chrismcc-gmail/dovecot-virtual-sendmail Basically I abused glibc's db feature in /etc/nsswitch in /var/db/Makefile something like this: $(VAR_DB)/passwd.db: /etc/dovecot/usersfile @printf %s "$(patsubst %.db,%,$(@F))... " @$(AWK) 'BEGIN { FS=":"; OFS=":" } \ /^[ \t]*$$/ { next } \ /^[ \t]*#/ { next } \ /^root/ { next } \ /^[^#]/ { printf ".%s ", $$1; \ printf "%s:x:65534:65534:%s:/home/vmail/%s:/sbin/nologin\n", $$1, $$1, $$1; \ }' $^ | \ $(MAKEDB) -o $@ - @echo "done." make -C /var/db getent passwd ; shows ... virtualuser:x:65534:65534:virtualuser:/home/vmail/virtualuser:/sbin/nologin othervuser:x:65534:65534:othervuser:/home/vmail/othervuser:/sbin/nologin A longer explanation and more info is in the github repository It takes about 10 minutes to go from new clean server to working email server with this I've been running this in production for about a week now without any problems. Question: Has anyone else done this? I don't see any downsides, but I might be missing something. -- Christopher McCrory To the optimist, the glass is half full. To the pessimist, the glass is half empty. To the engineer, the glass is twice as big as it needs to be.

2 1

Preventing deletion of mails in some directories?
by Philip Rhoades 18 May '22

18 May '22

People, I can't get the system "chattr" to do what I want so I am wondering if there is some way to prevent deletion of mails in the INBOX and the Sent folders? Renaming and moving files needs to be possible for Maildir functions and also for me - so I only need deletion prevention . . Is this possible from Dovecot? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

3 2

Can sync/migrate all mail from remote imap account except the main "INBOX"
by Darren Mobley 17 May '22

17 May '22

Greetings! I've been trying to sync my email to a server, however it only syncs the mail in folders other than INBOX. For testing purposes, I've created a fake domain, "letest.tld" and a new empty user account "mailto:saywhatnow@letest.tld" to receive the copy of the mail being migrated. What I've been trying are iterations of: /usr/bin/doveadm -D -o mail_fsync=never -o dsync_features=empty-header-workaround -o imapc_ssl=imaps -o imapc_features=rfc822.size,fetch-headers -o dsync_commit_msgs_interval=100 -o imapc_port=993 -o imapc_host=imap.zoho.com -o imapc_password=NoNoTRe4LLyMyP4$$ -o imapc_user=mailto:decker@n3t.net -o mail_prefetch_count=20 sync -1Ru mailto:saywhatnow@letest.tld imapc: Regardless of running sync -1 or backup (I want to keep original mailbox as-is for now) I get errors related to INBOX. With sync -1 ; May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Ignore nonexistent mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c with -1 sync May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Ignoring missing remote box GUID c92f64f79f0d1ed01e6d5b314f04886c May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Archive: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Archive: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Skipping unchanged mailbox 51a58e1d1d5c491aac71488647b20224 May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Commercial Spam: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Commercial Spam: Mailbox opened With backup : May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: brain M: Namespace INBOX. has location maildir:/home/letest/mail/letest.tld/saywhatnow:UTF-8 May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Namespace INBOX.: Using permissions from /home/letest/mail/letest.tld/saywhatnow: mode=0700 gid=default ... May 10 16:54:55 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Namespace INBOX. has location imapc: May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=1 subs=yes last_change=0 last_subs=1652217475 May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=8230 subs=yes last_change=0 last_subs=0 ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Remote mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=8230 subs=yes last_change=0 last_subs=0 ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: Mailboxes are equal ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: Mailboxes are equal ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Change during sync: Mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c was lost May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Change during sync: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) ... May 10 16:55:33 dsync(mailto:saywhatnow@letest.tld): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) This is odd, since that very GUID is in the uidlist file for the base folder: # grep -R Gc92f64f79f0d1ed01e6d5b314f04886c /home/letest/mail/letest.tld/saywhatnow /home/letest/mail/letest.tld/saywhatnow/dovecot-uidlist:3 V1 N1 Gc92f64f79f0d1ed01e6d5b314f04886c I've tried all sorts of things to get this to work, including removing the entire /home/letest/mail/letest.tld/saywhatnow/ directory so there could be no conflicts with existing mailbox, set mailbox_list_index=no , set lda_mailbox_autocreate=no , etc. The errors appear to originate from src/doveadm/dsync/dsync-brain-mailbox.c but it's not really telling me a lot. I'm using dovecot version 2.3.18 (9dd8408c18) on a cPanel server. `dovecot -n` output attached. Any help would be greatly appreciated! Thanks, Darren

3 5

Dovecot and RFC6856
by Tan Mientras 17 May '22

17 May '22

Hi. Just after upgrading *courier* from an old version, we are receiving warning messages instead of mails stating: "This E-mail message was determined to be Unicode-formatted but your E-mail reader does not support Unicode E-mail." warnings. It looks much like: *https://bugzilla.mozilla.org/show_bug.cgi?id=1571672 <https://bugzilla.mozilla.org/show_bug.cgi?id=1571672>* https://talk.plesk.com/threads/messages-with-unicode-unable-to-pick-up-via-… it seems, malformed mails (they showed errors before migration, but they were shown at least!) are handled incorrectly by thunderbird and the only option is to *revert backwards or migrate to dovecot*. *Does dovecot also implement RFC8656*? Will the same happen if we migrate to dovecot? Any plans for future adoption of that RFC?

2 1

Shared mailboxes, users with dots and a bug in subscriptions
by Tobias Stein 17 May '22

17 May '22

Hi, i'm running Dovecot 2.3.14.alpha0 with shared namespaces and stumbled across some errors messages logged, when the list of subscribed mailboxes is queried by a client. For every distinct account of in the list of subscriptions two corresponding lines are logged: Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/noc@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/info@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/root@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Similar messages are logged, when invalid entries are listed in '/var/lib/dovecot/db/shared-mailboxes', which i already pruned and haven't received them anymore since. I think these errors are caused by an unintended behaviour when writing "~/Maildir/subscriptions", which looks (shortened) like this. V 2 INBOX/INBOX shared/noc@example com/INBOX shared/info@example com/INBOX shared/root@example com/test shared/root@example com/test test_sub The subscription-file.c explodes the name on every hierarchy separator ('.','\0') and inserts a TAB character. Unfortunately it also explodes on the DNS label delimiter „.‟. This should probably be fixed by passing a structure containing the required information to the formatter to distinguish mailboxes from domain-names. Subscription in combination with multiple domains and shared mailboxes seems broken to me. Actually i can't even explain to me, why it is working in face of the errors. :-) Unfortunately in Maildir++ the separator dot is hard-coded. There is a very old thread on this mailing list, that suggests using „auth_username_translation‟ to replace dots with a different character, but this idea is getting worse the longer i think about it. I absolutely dislike the idea to set LAYOUT=fs, namespace/separator = § to change the separators to split on, because this would mean to restructure the physical layout of all mailboxes (hierarchically) and mess around with lots of files. I attached a dovecot-sysreport to reproduce the behaviour. /etc/dovecot/private/example.com/users looks like this: ### user:password:uid:gid:(gecos):home:(shell):extra_fields noc:{SSHA512}_hash_:::::: info:{SSHA512}_hash_:::::: root:{SSHA512}_hash_:::::: Please correct me if i'm wrong or point me to a workaround, but i think the layout code needs some love. :-) Best regards Tobias

2 4

Re: Permissions and ownership on /dev/shm/dovecot
by doug 16 May '22

16 May '22

1 0

Fatal Error after upgrade to 2:2.3.19-2+debian11
by Sebastian Kroczek 16 May '22

16 May '22

Hello all, I updated the server tonight and with it Dovecot from 2.2.27 to 2:2.3.19-2+debian11. However, there seems to be a problem with the ACLs, because since then fatal errors are logged (see core dump). I suspect that some outdated configuration is causing this behavior, but so far I couldn't figure out which one it could be. I also have no clue right now how to debug this further. Thank you very much for your help. If more information are needed, I will of course be happy to provide them. VG Sebastian ======== Error logs ========= May 16 13:33:43 Fatal: imap(user1(a)domain.com)<0r5YZR/fM4AfrHBI>: master: service(imap): child 238359 killed with signal 11 (core dumped) May 16 13:33:46 Fatal: imap(user2(a)domain.com)<Ul+kZR/fA4AfrHBI>: master: service(imap): child 238386 killed with signal 11 (core dumped) May 16 13:33:46 Fatal: imap(user3(a)domain.com)<VGOkZR/fG4AfrHBI>: master: service(imap): child 238387 killed with signal 11 (core dumped) May 16 13:34:54 Fatal: imap(user4(a)domain.com)<1WS6aR/fHoAfrHBI>: master: service(imap): child 238509 killed with signal 11 (core dumped) May 16 13:34:54 Fatal: imap(user2(a)domain.com)<mQu6aR/fBIAfrHBI>: master: service(imap): child 238508 killed with signal 11 (core dumped) May 16 13:35:27 Fatal: imap(user3(a)domain.com)<pWGYax/fE4AfrHBI>: master: service(imap): child 238589 killed with signal 11 (core dumped) May 16 13:35:27 Fatal: imap(user1(a)domain.com)<s/mgax/fG4AfrHBI>: master: service(imap): child 238590 killed with signal 11 (core dumped) ======== END Error logs ========= ======== dovecot.conf ========== # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-14-amd64 x86_64 Debian 11.3 # Hostname: wv-imap1.wavecloud.de auth_mechanisms = plain login default_vsz_limit = 4 G dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf } first_valid_gid = 5000 first_valid_uid = 5000 imap_capability = +XDOVECOT last_valid_gid = 5000 last_valid_uid = 5000 listen = 10.10.115.XX login_trusted_networks = 10.10.115.XX 10.10.115.XX mail_location = maildir:~/ mail_log_prefix = "%s(%u)<%{session}>: " mail_plugins = acl notify quota fts fts_solr virtual maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=/srv/vmail/_virtual/%u prefix = Virtual/ separator = / subscriptions = no } namespace shared { list = yes location = maildir:%%h:INDEX=~/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/dovecot-sql-password.conf driver = sql } passdb { args = /etc/dovecot/admin-sql.conf driver = sql master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl fts = solr fts_autoindex = yes fts_solr = url=http://wv-solr1.wavecloud.de:8983/solr/dovecot/ quota = maildir:User quota quota_rule = *:storage=20G quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = ~/.dovecot.sieve sieve_before = /var/vmail/globalsieverc sieve_max_script_size = 1M sieve_quota_max_scripts = 42 sieve_quota_max_storage = 10 } protocols = imap pop3 sieve lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = vmail mode = 0666 user = vmail } unix_listener auth-master { mode = 0666 } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { process_min_avail = 1 service_count = 0 vsz_limit = 500 M } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { executable = /usr/lib/dovecot/managesieve-login inet_listener sieve { address = 10.10.115.10 port = 4190 } process_min_avail = 1 service_count = 1 } service managesieve { executable = /usr/local/sbin/dovecot-managesieve.sh } service pop3-login { process_min_avail = 1 service_count = 1 } service quota-warning { executable = script /usr/local/sbin/quota-warning.sh user = vmail } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } shutdown_clients = no ssl_cert = </etc/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 2048 mail_plugins = acl notify quota fts fts_solr virtual imap_quota imap_acl } protocol pop3 { mail_plugins = acl notify quota fts fts_solr virtual pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { hostname = wv-imap1.wavecloud.de mail_fsync = optimized mail_plugins = acl notify quota fts fts_solr virtual sieve postmaster_address = postmaster(a)example.com quota_full_tempfail = yes sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } protocol lmtp { mail_fsync = optimized mail_plugins = acl notify quota fts fts_solr virtual sieve } ======== END dovecot.conf ========== ======== Core-Dump ================= PID: 240475 (imap) UID: 5000 (vmail) GID: 5000 (vmail) Signal: 11 (SEGV) Timestamp: Mon 2022-05-16 13:49:56 CEST (1min 17s ago) Command Line: dovecot/imap [user1(a)domain.com XX.XX.XX.XX MYRIGHTS] Executable: /usr/lib/dovecot/imap Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: acb78ce2252049778ff969755d277453 Machine ID: 1367ff1e75be457cacbf5e204a28711b Hostname: wv-imap1 Storage: /var/lib/systemd/coredump/core.imap.5000.acb78ce2252049778ff969755d277453.240475.1652701796000000.zst Message: Process 240475 (imap) of user 5000 dumped core. Stack trace of thread 240475: #0 0x00007f5db938c17c acl_mailbox_get_aclobj (lib01_acl_plugin.so + 0xf17c) #1 0x00007f5db93776ed n/a (lib02_imap_acl_plugin.so + 0x36ed) #2 0x000055f5568444d4 command_exec (imap + 0x224d4) #3 0x000055f55684244f n/a (imap + 0x2044f) #4 0x000055f5568424fa n/a (imap + 0x204fa) #5 0x000055f5568429d5 client_handle_input (imap + 0x209d5) #6 0x000055f556842f40 client_input (imap + 0x20f40) #7 0x00007f5db9682529 io_loop_call_io (libdovecot.so.0 + 0x118529) #8 0x00007f5db9683c12 io_loop_handler_run_internal (libdovecot.so.0 + 0x119c12) #9 0x00007f5db96825d0 io_loop_handler_run (libdovecot.so.0 + 0x1185d0) #10 0x00007f5db9682790 io_loop_run (libdovecot.so.0 + 0x118790) #11 0x00007f5db95f5353 master_service_run (libdovecot.so.0 + 0x8b353) #12 0x000055f556833f0a main (imap + 0x11f0a) #13 0x00007f5db93c5d0a __libc_start_main (libc.so.6 + 0x26d0a) #14 0x000055f556833fca _start (imap + 0x11fca) =========== END Core-Dump ============= -- Wavecon GmbH Anschrift: Gustavstraße 18, 90762 Fürth Website: www.wavecon.de Support: support(a)wavecon.de Telefon: +49 (0)911-1206581 (werktags von 9 - 17 Uhr) Hotline 24/7: 0800-WAVECON Fax: +49 (0)911-2129233 Registernummer: HRB Fürth 18164 GF: Cemil Degirmenci UstID: DE251398082 Pflichtinformationen nach Art. 13 DSGVO siehe wavecon.de/de/datenschutz

3 5

TLS renegotiation issue (CVE-2011-1473) in Dovecot
by Greg Earle 16 May '22

16 May '22

Hello, At work I'm running a Dovecot 2.3.15 server on a RHEL 7.9 system with OpenSSL 1.0.2k. Our IT Security people are threatening to shut it down because of this: > We were notified of a possible TLS renegotiation vulnerability on > [FQHN]. > > [Parent organization] ticket NNNNNNN is open to track efforts. > > We conducted a manual test on the site for TLS Renegotiation on IMAP > port 993. > > We found that this was set to enabled. > > In order to remediate we will need to either: > > 1. Disable Renegotiation (preferred) > 2. Set a max aggregated renegotiation > > Please remediate as soon as possible. > > References: > > https://support.f5.com/csp/article/K15278 > > https://nvd.nist.gov/vuln/detail/cve-2011-1473 > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1473 I did some Googling and among the results, I found a few old posts from this mailing list among them, which to summarize basically seemed to say "Yeah, we could write some code ... " but that was about it. The IT Security rep sent me a reference to an ancient Red Hat article https://access.redhat.com/articles/23543 which is hysterical - ancient history, references NSS and Tomcat, suggests changes to an add-on product (Red Hat Certificate Server) that is EOL, etc. Is there any way to mitigate this issue? (The only thing I can think of is to upgrade the Dovecot server to RHEL 8 and restrict connections to only TLSv1.3, but that ain't gonna happen overnight.) Thanks, - Greg

3 2

Duplicate messages if message is moved when using dsync
by Thom Pol 16 May '22

16 May '22

Hi, Hope you are well. We have a cluster of 2 Dovecot servers, both on v2.3.13 (89f716dc2), using dsync to sync the messages between them. Previously, we used TCPS to sync the messages, but after some testing, we concluded that syncing over SSH resulted in a lot less failed syncs, so we started using SSH. The change has been a success, but I now notice a issue when a email client immediately moves a messages to a separate folder while Dovecot is syncing, where the message is seen twice in the folder (with the exact same headers/content). For example, I have set a filter in my email client, Thunderbird, to immediately move all emails coming from this list to a separate folder. When opening that folder, I do not see one, but two unread messages, both identical to each other. When checking the directories on the server, I see this: mx1: /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615808.M190190P990486.mx2,S=19089,W=19384:2,S /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615811.M180050P1376677.mx1,S=19089,W=19384:2,S mx2: /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615811.M981426P990530.mx2,S=19089,W=19384:2,S /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615808.M190190P990486.mx2,S=19089,W=19384:2,S Note the difference: on mx1, one indicates mx1, and one mx2, while on the other server, both indicate mx2/ Any idea (other then telling end-users not to use such filters) how we could prevent these duplicate messages? This is our config: # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-13-cloud-amd64 x86_64 Debian 11.3 # Hostname: mx1.example.com auth_mechanisms = plain login disable_plaintext_auth = no dsync_remote_cmd = ssh -p 222 -l%{login} %{host} doveadm dsync-server -u%u imap_capability = +SPECIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_max_userip_connections = 100 mail_plugins = quota mail_privileged_group = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_replica = remote:root@mx2.example.com quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M } protocols = imap pop3 lmtp replication_max_conns = 50 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_cipher_list = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { auth_verbose = yes mail_plugins = quota quota imap_quota quota notify replication } protocol pop3 { auth_verbose = yes mail_plugins = quota quota quota notify replication pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve quota sieve quota notify replication postmaster_address = postmaster(a)mx1.example.com } protocol lmtp { mail_plugins = quota quota sieve sieve quota notify replication postmaster_address = postmaster(a)mx1.example.com } Thanks in advance for your thoughts. Kind regards, Thom Pol

2 1