May 2023 - dovecot - dovecot.org

Re: LMTP server client certificate validation
by Jochen Bern 19 May '23

19 May '23

On 16.05.23 14:27, Sean Gallagher wrote: > I have a created a CA for the sole purpose of signing the certificate of > the LMTPS client. I regard this as a horrible horrible kludge. ... how do you figure that? *Someone*, and that means you, has to specify which clients are allowed to connect. Which leaves three possibilities: a) You run the CA and thus, the CA can do the selection for you. Which means that in order to deal with a single-permissible-client situation, you need the CA to issue client certs to just that one entity. b) The CA does *not* and issues (client) certs to entities you do *not* want to grant access. Then the selection job remains yours and, assuming that requiring a client cert from that CA makes any sense in the first place, auth_ssl_username_from_cert is there to help you (by making sure that the username will be "the ID" from the cert so that you can base some additional filtering on that). c) The CA is willing to enrich the certs it issues with DN parts, X509v3 extensions or the like signalling access rights as granted beforehand by a *fourth* party, as in, you. Which is a terrible can of worms as soon as things, especially the number of such fourth parties to support by the same CA, start to scale up IMHO. Which promptly brings us back to you running the CA yourself ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

3 5

Possible hack via doveadm
by Daniel L. Miller 18 May '23

18 May '23

I currently have two servers running with synchronization that I've been very happy with. However, I'm seeing the following in my logs recently: May 12 15:45:58 cloud1 dovecot: doveadm(194.165.16.78): Error: doveadm client not compatible with this server (mixed old and new binaries?) May 13 03:44:31 cloud1 dovecot: doveadm(45.227.254.48): Error: doveadm client not compatible with this server (mixed old and new binaries?) Since I don't recognize those IPs, the first is out of Panama and the other is Belize, I assume these are hostile attackers trying to exploit something. How can I defend against this? -- Daniel

5 6

pigeonhole: sieve: float score failed for comparator-i ascii-numeric
by Randy Li 18 May '23

18 May '23

Hello Following the sieve_spamtest_status_header from the document, I think I could extract the score from the spamassassin (which is from spampd lmtp). But sieve script can't never work properly with comparator "i;ascii-numeric". I have used sieve-test several times, once I remove the dot from the mail sample, the sieve script works well. I noticed that document says i;ascii-numeric is for unsigned integer only which certainly does work for this case. The score here would be signed float(all right all the float is signed) and it is a float variable from tst-spamvirustest.c. I think that is the place the bug happened. Unfortunately, I didn't found any RFC that supports a float comparator and I am not familiar with the sieve interrupter. If someone could give me a possible method to fix this, I could submit a patch. Sincerely Randy Li

2 2

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

> OK, that does make sense so far. Today I have checked, and the correct > dates seem to be showing up now after the initial date (ever since that > initial run of the "dovecot expunge" command was run on all mailboxes). > So in our case I have the expunge set to delete older than 30 days. I > assume if I wait 30 days from now, it will start working? Yup. If you run your script every day (and thus, run "doveadm fetch ... date.saved" as well), that will make sure any new mail put into your Trash folder will have date.saved within 24h of the "real" value. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

Chris Szilagyi <chris(a)apex-internet.com> writes: > Recently, I noticed that our expunge script is not working, and I don't > think it ever has on this server. On further inspection, it looks like > the saved date for emails in the folders we want to expunge is set to a > recent date (yesterday) for almost all messages. For example, when I > run the command "doveadm -f tab fetch -u username date.saved mailbox > Trash", the date for almost all of the messages is yesterday at the > exact same time. I tried this on other users and they have this exact > same timestamp shown for most of their messages, too. > > I tried checking for "date.received" and that shows correct, it is > "date.saved" that is not working. > > Any idea of how or why this would not be showing the correct date? I've > used this setup in the past on other servers with dovecot and it has > worked great, no idea why we would be seeing this issue now. I recall having the same problem. I think the "date.saved" is not instantiated in the cache until you query for it. So the value you were shown is when you last dumped its value if it wasn't previously set -- your run of same values coincided when you ran "doveadm fetch". My expunge script just uses date.received instead -- it seems to work. Joseph Tam <jtam.home(a)gmail.com>

2 1

[PATCH] [WIP]: thunderbird mboxrd to mbox
by Randy Li 16 May '23

16 May '23

I was trying to restore email from local thunderbird download data. None of the script I found could work. This script is modified from superuser.com/questions/105653/how-to-convert-mboxo-mboxrd-to-mboxcl-mboxcl2 Which works for me, using this script I could use doveadm import to restore my INBOX(I don't know how to restore the Sent mailbox). If this script is useful, I would rewrite one for python3 and following the mboxrd spec. Signed-off-by: Randy Li <ayaka(a)soulik.info> --- mailman2mbox.py | 111 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100755 mailman2mbox.py diff --git a/mailman2mbox.py b/mailman2mbox.py new file mode 100755 index 0000000..1a154b7 --- /dev/null +++ b/mailman2mbox.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python2 +""" +Usage: ./mailman2mbox.py infile outfile default-to-address +""" +import sys +from time import strftime,strptime,mktime,asctime +from email.utils import parseaddr,formatdate + +if len(sys.argv) not in (3,4): + print __doc__ + sys.exit() + +out = open(sys.argv[2],"w") +listid = None +if len(sys.argv)==4: + listid = sys.argv[3] + +date_patterns = ("%b %d %H:%M:%S %Y", "%d %b %H:%M:%S %Y", "%d %b %Y %H:%M:%S", "%d %b %H:%M:%S", "%d %b %y %H:%M:%S", "%d %b %Y %H.%M.%S",'%m/%d/%y %H:%M:%S %p') + +class HeaderError(TypeError): + pass + + +def finish(headers, body): + body.append("\n") + for n,ln in enumerate(headers): + if ln.startswith("Date:"): + break + else: + raise HeaderError("No 'Date:' header:\n" + "".join(headers)+"\n") + if listid is not None: + for ln2 in headers: + if ln2.lower().startswith("list-id:"): + break + else: + headers.append("List-Id: <%s>\n" % (listid,)) + date_line = ln[5:].strip() + if date_line.endswith(')'): + date_line = date_line[:date_line.rfind('(')].rstrip() + if date_line[-5] in "+-": + date_line, tz = date_line[:-5].rstrip(), int(date_line[-5:])//100 + else: + tz = -5 + if date_line[:3] in ("Mon","Tue","Wed","Thu","Fri","Sat","Sun"): + if date_line[3:5] == ', ': + prefix = "%a, " + elif date_line[3] == ',': + prefix = "%a," + else: + prefix = "%a " + else: + prefix = "" + while True: + for p in date_patterns: + try: + date_struct = strptime(date_line, prefix+p) + except ValueError: + pass + else: + break + else: + if not date_line: + raise ValueError(headers[n]) + date_line = date_line[:date_line.rfind(' ')] + continue + break + + date_struct = list(date_struct) + try: + headers[n] = 'Date: %s\n' % (formatdate(mktime(date_struct),True)) + headers[0] = "From %s %s\n" % (headers[0][:-25].rstrip(), asctime(date_struct), ) + except ValueError: + raise ValueError(headers[n]) + + for w in headers, body: + for s in w: + out.write(s) + + +message = 0 +headers, body = None, None +for line in open(sys.argv[1]): + if line.startswith("From "): + message+=1 + header = True + if headers is not None: + try: + finish(headers, body) + except HeaderError: + message -= 1 + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + headers, body = [], [] + line = line.replace(" at ", "@") + elif line == '\n': + header = False + elif header and line.startswith('From:'): + line = line.replace(" at ","@") + (headers if header else body).append(line) + +try: + finish(headers, body) +except HeaderError: + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + +out.close() -- 2.40.1

2 1

Incorrect saved dates in mailboxes
by Chris Szilagyi 16 May '23

16 May '23

Hello: We have a server (Debian 11) using Dovecot 2.3 which has been in place for about a year. We are using mbox format for our mailboxes, and do not use MySQL, just plain user directories under /home. Recently, I noticed that our expunge script is not working, and I don't think it ever has on this server. On further inspection, it looks like the saved date for emails in the folders we want to expunge is set to a recent date (yesterday) for almost all messages. For example, when I run the command "doveadm -f tab fetch -u username date.saved mailbox Trash", the date for almost all of the messages is yesterday at the exact same time. I tried this on other users and they have this exact same timestamp shown for most of their messages, too. I tried checking for "date.received" and that shows correct, it is "date.saved" that is not working. Any idea of how or why this would not be showing the correct date? I've used this setup in the past on other servers with dovecot and it has worked great, no idea why we would be seeing this issue now. Thanks in advance. Chris

2 1

[feature request] SSL handshake rejection for non-SNI clients
by Serg 16 May '23

16 May '23

I would like to offer to implement a feature to reject SSL handshakes for a default certificate-key pair for efficiently discarding bot requests (i.e. such requests that provide invalid/not configured hostname or do not specify at all, like when doing request to the IP address directly). Nginx has such feature already implemented as seen here[1], and it would be beneficial if dovecot would support this too. Currently I am using the following SSL configuration snippet to mimic such behavior: > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_key = </etc/ssl/dovecot/server.key > > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = </etc/ssl/domains/flopster.at.encryp.ch/key > } But in this case the problem is that the invalid requests (for this example it is requests that don't have Server Name Indication at all or mention anything else but not flopster.at.encryp.ch) are still being replied by Dovecot with a TLS certificate rather than being simply rejected with a TLSV1_UNRECOGNIZED_NAME error code. [1]: <https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake>

3 3

Re: [External] Re: Help - Permissions issue with new mail
by Mihai Badici 16 May '23

16 May '23

Sorry, I sent the reply directly to you not to the list. I try to find which is the uid expected by dovecot. Usually since in postfix the uid is set as 5000 you need to have the same "virtual" uid set in dovecot. I didn't see this in the fail you sent. Maybe you made some change in the past without restarting dovecot. Anyway i think a line like mail_uid=5000 somewhere in dovecot configuration ( location may differ )should fix your issue. Try to find if this is already set and if not add this in dovecot and restart it. On 2023-05-04 15:16, Michele Clark wrote: > Attached is a copy of my main.cf from postfix and my 10-mail from > dovecot > > Let me know if you see anything that I might try - Thanks in advance > > Michele Clark > Title | Engineering Business Unit > KBR | Government Solutions – US > Office: +1 937-713-8669 > > ------------------------- > > From: Mihai Badici <mihai(a)badici.ro> > Sent: Wednesday, May 3, 2023 3:44 PM > To: Michele Clark <Michele.Clark(a)us.kbr.com> > Subject: Re: [External] Re: Help - Permissions issue with new mail > > You don't often get email from mihai(a)badici.ro. Learn why this is > important [1] > > CAUTION: This email originated from outside of the organization. Do > Re: [External] Re: Help - Permissions issue with new mail Contact photo From Michele Clark on 2023-05-04 15:16 Details Headers Plain text Download all attachmentsSave all to cloud... 10-mail.conf.jpg.docx(~761 KB) MAIN.CF.JPG(~161 KB) Attached is a copy of my main.cf from postfix and my 10-mail from dovecot Let me know if you see anything that I might try - Thanks in advance Michele Clark Title | Engineering Business Unit KBR | Government Solutions – US Office: +1 937-713-8669 From: Mihai Badici <mihai(a)badici.ro> Sent: Wednesday, May 3, 2023 3:44 PM To: Michele Clark <Michele.Clark(a)us.kbr.com> Subject: Re: [External] Re: Help - Permissions issue with new mail You don't often get email from mihai(a)badici.ro. Learn why this is important CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I think the problem isn't the rights of the files but dovecot need to use the same user for read them. I have something like: mail_uid = 5000 in 10-mail.conf, this uid need to be the same as in postfix On 5/3/23 21:42, Michele Clark via dovecot wrote: > 1: This was previously working but has been down since there was an > unexpected power outage. This install has been in place for several > years > 2: When I chmod -r the CUR folder I can get mail to drop to our > roundcube inbox or if I chmod the actual email file in the cur folder > (have tried > not click links or open attachments unless you recognize the sender > and know the content is safe. > > I think the problem isn't the rights of the files but dovecot need to > use the same user for read them. > > I have something like: mail_uid = 5000 in 10-mail.conf, this uid need > to be the same as in postfix > > On 5/3/23 21:42, Michele Clark via dovecot wrote: > >> 1: This was previously working but has been down since there was an >> unexpected power outage. This install has been in place for several >> years >> 2: When I chmod -r the CUR folder I can get mail to drop to our >> roundcube inbox or if I chmod the actual email file in the cur >> folder (have tried both) however new messages still come thru with >> -rw------- >> 3. Attached is a copy of the return from comm -23 <(postconf -n) >> <(postconf -d) with the exception of a few redactions for our >> personal data >> 4. What info would you like to see from dovecot? >> >> Any help is much app >> >> Michele Clark >> Title | Engineering Business Unit >> KBR | Government Solutions – US >> Office: +1 937-713-8669 >> >> ------------------------- >> >> From: John Stoffel <john(a)stoffel.org> >> Sent: Wednesday, May 3, 2023 2:14 PM >> To: Michele Clark <michele.clark(a)us.kbr.com> >> Cc: dovecot(a)dovecot.org <dovecot(a)dovecot.org> >> Subject: [External] Re: Help - Permissions issue with new mail >> >> [You don't often get email from john(a)stoffel.org. Learn why this is >> important at https://aka.ms/LearnAboutSenderIdentification [1] ] >> >> CAUTION: This email originated from outside of the organization. Do >> not click links or open attachments unless you recognize the sender >> and know the content is safe. >> >>>>>>> "michele" == michele clark--- via dovecot >> <dovecot(a)dovecot.org> writes: >> >>> We have an install of Dovecot running with Postfix and Roundcube >>> using virtual mail to allow us to connect to our AD domain which >> got >>> messed up after a power issue. >> >> Was this working before the AD problems, or is this a new install? >> >>> I can log into our Roundcube and see all my old emails, however >> new >>> emails keep getting stuck in the CUR files with permissions of >>> -rw------- >> >>> If I chmod the email it will deliver to the inbox in Roundcube. >> >> Where are you changing the permissions? The destination directory? >> >>> Can anyone advise on how I can adjust this so all new emails will >>> come thru with the correct permissions? - Thanks in advance >> >> It all depends on how your email are delivered, and you need to post >> some of your configuration details, such as the postfix config and >> the >> dovecot config. >> >> For postfix, just post the changed from defaults info, which you can >> get with the following bash sheel command: >> >> comm -23 <(postconf -n) <(postconf -d) >> >> See the postconf man page for details. >> >> Also post your dovecot info as well. >> >> This e-mail, including any attached files, may contain confidential >> information, privileged information and/or trade secrets for the >> sole use of the intended recipient. Any review, use, distribution, >> or disclosure by others is strictly prohibited. If you are not the >> intended recipient (or authorized to receive information for the >> intended recipient), please contact the sender by reply e-mail and >> delete all copies of this message. >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org > This e-mail, including any attached files, may contain confidential > information, privileged information and/or trade secrets for the sole > use of the intended recipient. Any review, use, distribution, or > disclosure by others is strictly prohibited. If you are not the > intended recipient (or authorized to receive information for the > intended recipient), please contact the sender by reply e-mail and > delete all copies of this message. > > Links: > ------ > [1] https://aka.ms/LearnAboutSenderIdentification

4 9

replicator service
by Przemysław Kwiatkowski 15 May '23

15 May '23

I'm confused. Replicator service is bidirectional. Does it mean I should start it only on *one* end of a replication pair? Or on both, working simultaneously? -- MiCHA

2 1