November 2023 - dovecot

[CFP] "Modern Email" Developer Room at FOSDEM '24
by Joris Baum 23 Nov '23

23 Nov '23

Hi, There will be a developer room that I think will be of particular interest for subscribers of this mailing list for "Modern Email" during FOSDEM '24. It will center around the current state of email, free/open source software projects related to email and current developments. FOSDEM is and event for free software and open source developers. The event encompasses two main streams: talks curated by organizers covering diverse topics and the developer rooms. Spread across multiple buildings at the venue, the developer rooms are focusing on specific concepts, technologies, and ideas. This is where the fun is. And most of the fun will obviously happen in the "Modern Email" room. The submission deadline for proposals is 1st December 2023. You can find more info on GitHub: https://github.com/modern-email/FOSDEM-24 . Regards, Joris Baum -- Joris Baum Tel: +49 721 170293 16 Fax: +49 721 170293 179 http://www.audriga.com | http://www.twitter.com/audriga -------------------------------------------------------------------------- audriga GmbH | Alter Schlachthof 57 | 76137 Karlsruhe Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034 Geschäftsführer: Dr. Frank Dengler, Dr. Hans-Jörg Happel --------------------------------------------------------------------------

2 2

Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Michael Peddemors 21 Nov '23

21 Nov '23

There is a network claiming to be a security company, however the activity appears to be a little more malicious, and appears to be attempting buffer overflows against POP-SSL services.. (and other attacks). https://www.abuseipdb.com/check/104.156.155.21 Just thought it would be worth mentioning, you might want to keep an eye out for traffic from this company... Might want to make up your own mind, or maybe someone has more information, but enough of a red flag, that thought it warranted posting on the list. Not sure yet if it is Dovecot, or the SSL libraries they are attempting to break, but using a variety of SSL/TLS methods and connections... Anyone with more information? NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

11 15

dovecot and oauth2 (with keycloak) not working
by Francis Augusto Medeiros-Logeay 20 Nov '23

20 Nov '23

Hi, I successfully configured Roundcube to use keycloak for oauth2. However, I am having trouble to make it work with dovecot. My configuration is this: cat dovecot-oauth2.conf.ext tokeninfo_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/userinfo introspection_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/token/intr… introspection_mode = post username_attribute = postfixMailAddress debug = yes scope = openid Roundcube_email This is what I am getting from the logs: Nov 20 08:20:30 auth: Error: ldap(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): ldap_bind() failed: Constraint violation Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host session created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: IPs have expired; need to refresh DNS lookup Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Performing asynchronous DNS lookup Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Submitted (requests left=1) Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: DNS lookup successful; got 1 IPs Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443 (shared): Peer created Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Peer pool created Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Peer created Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Setting up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) (1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Linked queue https://auth.mydomain.com:443 (1 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Started new connection to 10.10.100.10:443 (SSL=auth.mydomain.com) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Making new connection 1 of 1 (0 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connecting Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Waiting for connect (fd=23) to finish for max 0 msecs Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: HTTPS connection created (1 parallel connections exist) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Client connection failed (fd=23) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Connection failed (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Failed to make connection (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Failed to establish any connection within our peer pool: connect(10.10.100.10:443) failed: Connection refused (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) connect(10.10.100.10:443) failed: Connection refused (1 peers pending, 1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Unlinked queue https://auth.mydomain.com:443 (0 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up any connection; failing all queued requests Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Error: 9003 connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Dropping request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Nov 20 08:20:30 auth: Error: oauth2(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): oauth2 failed: connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Destroy (requests left=1) Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Free (requests left=0) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection close Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection disconnect Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Disconnected: connect() failed: Connection refused (fd=23) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Detached peer Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection destroy Nov 20 08:20:32 imap-login: Info: Disconnected (auth service reported temporary failure): user=<francis(a)mydomain.com>, method=XOAUTH2, rip=10.10.40.30, lip=172.18.0.10, TLS, session=<yskzUpAKb9EKCige> My dovecot version is 2.3.7.2 (3c910f64b). I find it odd that it is sending the token as a parameter, when I chose “post” as the introspection mode. But I don’t know if that is the problem. best, Francis

3 6

Avoiding POODLE vulnerability
by Steve Litt 20 Nov '23

20 Nov '23

Hi all, Ten years after the fact I learned about POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerabilities, which enable a poorly configured server to force my client to downgrade to vulnerable encryption. My current conf.d/10-ssl.conf contains the following line: ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL I've read that I should change the preceding line to the following: ssl_protocols = !SSLv3 !SSLv2 Is this correct? For some reason I have the same ssl_cipher_list in dovecot.conf. Should I make the change there too? Is there anything else I need to change? The following is my current dovecot.conf: ================================================= # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # OS: Linux 5.10.12_1 x86_64 # Hostname: mydesk.domain.cxm mail_location = maildir:~/mail/Maildir:INBOX=~/mail/Maildir/.INBOX namespace inbox { inbox = yes location = prefix = } passdb { driver = pam args = %s } userdb { driver = passwd } protocols = imap service imap-login { inet_listener imap { #port = 143 port = 0 } inet_listener imaps { port = 993 #port = 0 ssl = yes #ssl = no } } ssl = required #ssl = yes ssl_cert = </etc/ssl/dovecot_certs/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL ssl_key = </etc/ssl/dovecot_certs/private/dovecot.pem ================================================= By the way, does the preceding dovecot.conf even use the files in directories off conf.d ? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

3 8

passdb doesn't support credential lookups
by Michael Grant 20 Nov '23

20 Nov '23

I'm having trouble authenticating certain users. I see this in the logs: Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Performing passdb lookup Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): passdb doesn't support credential lookups Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Finished passdb lookup at the command line, if I run this: % doveadm auth login jane Password: passdb: jane auth succeeded Oddly, I have a handfull of users that are failing and others that are not and I don't see the difference.

1 0

Re: DMARC Failures for Mailing List
by dovecot＠x9p.org 18 Nov '23

18 Nov '23

On 11/17/23 10:38, Nick Lockheart wrote: > The DKIM check is also failing. I think the list software may be re-writing the > message bodies. I believe one of the reasons for the DKIM failure is this addition/configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email todovecot-leave(a)dovecot.org >>>>>>>> --x9p On 11/17/23 10:38, Nick Lockheart wrote: The DKIM check is also failing. I think the list software may be re- writing the message bodies. I believe one of the reasons for the DKIM failure is this addition/ configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org >>>>>>>> --x9p

1 0

DMARC Failures for Mailing List
by Nick Lockheart 18 Nov '23

18 Nov '23

Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re- writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message. Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re-writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message.

4 3

how to filter in doevecot/lmtp with sieve according to postfix orig_to value
by TSHIMANGA Minkoka 17 Nov '23

17 Nov '23

Dear All, I am managing an email infrastructure running with the below. Rocky Linux 8.7 (Green Obsidian) 4.18.0-425.3.1.el8.x86_64 postfix-3.5.8-4.el8.x86_64 dovecot-2.3.16-3.el8.x86_64 dovecot-pigeonhole-2.3.16-3.el8.x86_64 In reality there are more packages installed and configured. But I limited my enumeration above to what I think is relevant. I will be happy to provide more details if needed and/or requested. Here is my problem, or at least on what I need help/guidance/assistance. I have a virtual alias that forward emails to support(a)example.com to my inbox tshimanga.minkoka(a)example.com. That works fine as I can see those emails in my INBOX. And I want those emails to be moved in INBOX/support with a local sieve rule. For that I have the below that works. # rule:[support] if allof (header :is "to" "support(a)example.com") { fileinto :create "INBOX/support"; } The problem is that the above sieve rule seems not enough to catch email where support(a)example.com is not the "To" fields, as with cases of "Cc:" or "Bcc:". In the log of postfix, I can see lines with "... postfix/lmtp ... orig_to=<support(a)example.com> ...". The problem I am facing is that "orig_to" is not part of the headers postfix/lmtp (in reality dovecot/lmtp process) can see in order to apply on it a sieve rule. Any suggestions on how I can also sieve filter those emails ? Regards, Tshimanga

2 2

auth service over tls
by ibra 17 Nov '23

17 Nov '23

Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing? Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing?

4 5

Re: Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Joseph Tam 16 Nov '23

16 Nov '23

On Wed, 15 Nov 2023, 23:25 Michael Peddemors, <michael(a)linuxmagic.com> wrote: > Not sure yet if it is Dovecot, or the SSL libraries they are > attempting > to break, but using a variety of SSL/TLS methods and connections... > > They are not interested in dovecot per se. They scan for TLS vulnerabilities, > mostly. They're running comprehensive port scans, so they're targeting more than just SSL services. > OrgName: Academy of Internet Research Limited Liability > Company > OrgId: AIRLL > Address: #A1- 5436 > Address: 1110 Nuuanu Ave > City: Honolulu > StateProv: HI > PostalCode: 96817 > Country: US Out of business virtual offices, naturally. AIRLL also operating out of 195.96.137.0/24. Joseph Tam <jtam.home(a)gmail.com>

3 2