June 2023 - dovecot - dovecot.org

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

4 4

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

1 0

el9 rpms
by Marc 21 Jun '23

21 Jun '23

Is there a specific reason why there are (still) no el9 packages? https://repo.dovecot.org/ce-2.3.17/centos/ https://repo.dovecot.org/ce-2.3-latest/rhel/

4 7

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot reposting inactivity as auth failed
by pedro＠netsecpt.pt 20 Jun '23

20 Jun '23

Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Dovecot Version : 2.3.19.1 (9b53102964) Log imap line with issues : dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<myemail@mydomain>, method=PLAIN, rip=xxx.xxx.xx.xx, lip=xxx.xxx.xxx.xxx, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<some_hash> Thank you

3 6

Submission behaviour
by André Rodier 20 Jun '23

20 Jun '23

Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password. Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server. Here an example, of nftable ruleset, for dovecot imap(s): ------------------------------------------------------------------- table inet filter { set banned_imap_ipv4 { type ipv4_addr flags dynamic,timeout timeout 1d } set banned_imap_ipv6 { type ipv6_addr size 65535 flags dynamic,timeout timeout 1d } chain input { # Limit new imap connections ala fail2ban meta nfproto ipv4 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } meta nfproto ipv6 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr } # Reject the traffic explicitly ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited tcp dport { imap, imaps } ct state new counter accept \ comment "Accept imap/imaps connections" } } ------------------------------------------------------------------- Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android. There is also a way to save the rules before restarting the firewall, which works very well as well: ------------------------------------------------------------------- # nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } } ------------------------------------------------------------------- Now, the question I have is this. I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP. However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587) Thanks for your insights.

1 0

Re: Dovecot reposting inactivity as auth failed
by Joseph Tam 20 Jun '23

20 Jun '23

From: pedro(a)netsecpt.pt > Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . > Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Putting aside the semantics that not supplying credentials before the timeout *is* an auth failure, I would think the best way to handle this is to change the pattern fail2ban triggers to be more specific about what it considers an auth failure. If this is a typical log entry you want to avoid an automatic ban dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user= ... I would modify /etc/fail2ban/filter.d/dovecot.conf to limit it to 0-99sec like so failregex = ...( in \d{1,2} secs)... Some BFD attempts will leak through but it avoids triggering on any inactivity >99s. Joseph Tam <jtam.home(a)gmail.com>

1 0

Cannot get mail-crypt plugin to work
by rcooper＠dwford.com 16 Jun '23

16 Jun '23

dovecot 2.2.27 and then 2.2.36 (tried both) Trying to enable mail-crypt in global key mode. Nothing is ever encrypted, even when I move mail from folder to folder. I have tried everything available to find here, google, etc and I assume I am missing something fundamental. Debug log shows the plugin loading Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Loading modules from directory: /usr/lib/dovecot Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Module loaded: /usr/lib/dovecot/lib10_mail_crypt_plugin.so Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled (I assume because global not per user) my 10-mailcrypt.conf in .conf.d mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_global_private_key = </certs/ecprivkey.pem mail_crypt_global_public_key = </certs/ecpubkey.pem mail_crypt_save_version = 2 } I have also tried base64 encoded .pem files inline. I have also added the mail_plugins line to my protocol definitions to no avail and when I do that dovecot -n shows the lines as mail_plugins = " mail_crypt mail_crypt" so I assume it's a mistake to add mail_plugins = $mail_plugins mail_crypt to the protocol sections. Some online tutorials say must do this and others do not mention it at all. Just looking for some guidance as to where to go next.

3 4

zlib compressed folders
by Michael Grant 15 Jun '23

15 Jun '23

I’ve been playing with zlib compressed mail archives. I can’t seem to get it to work. I followed the instructions here: https://doc.dovecot.org/configuration_manual/zlib_plugin/ I’m not interested in being able to save, just read-only would be great. I have some compressed mail archives, for example 2020.gz in my ~/mail/ directory. I have some uncompressed ones too like 2021. Both are mbox formatted. In my imap client, I see both 2020.gz and 2021 as imap folders. I can access mail in 2021 but not in 2020.gz. It just says it’s empty. My local.conf has this in it: mail_plugins = $mail_plugins zlib I know for sure this is being read because if I change this to some non-existent plugin, I see an in the log complaining about a non-existent plugin. I’ve tried also adding in the lines for saving but no difference. Would love to know if there’s something more I need to do. Also, should I expect to see a folder named 2020 instead of 2020.gz in my imap clients? My suspicion is that dovecot is treating these as uncompressed imap folders which it can’t read because they look like garbage. Is there some doveadm command to get it to re-scan folders that I need to run and then realize this is a folder using zlib? Michael Grant

3 3

Empty oldstats
by djdejawu＠gmail.com 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964) BR, DeJa

1 0