August 2023 - dovecot

fail2ban / ldap login failure
by micha＠micha.waw.pl 05 Aug '23

05 Aug '23

[Debian Bookworm + Dovecot 2] I have user database in ldap (samba). I want to use fail2ban to restrict unsuccessful login attempts, but... I cannot see "Authentication failure" message in ANY log. (/var/log/mail.log shows successful logins as well as disconnects.) How should I proceed?

2 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

Using / in folder names
by Scott 04 Aug '23

04 Aug '23

Is this possible at all ? I am trying to import a PST file and it has a slash in the folder name. Dovecot errors out with : APPEND "Caixa de Entrada_VIDA/S1" (\Seen) NO [CANNOT] Invalid mailbox name: Name must not have '/' characters My namespace separator is the dot and I configured the listescape plugin to escape / but it still doesn't work. The listescape documentation says: The / character is disallowed on POSIX systems. This plugin allows you to use all of these characters, as long as the virtual separator (i.e. what is set by the separator setting and used as such by the IMAP protocol) is changed to something else, which means that the plugin does not make it possible to use the virtual separator in folder names. So it seems that as long as I use the dot, it should work ? Except it doesn't... How can I do this import ? Thank you!

3 9

RE: Forcing imap authentication failure for certain IP addresses
by aki.tuomi 02 Aug '23

02 Aug '23

One way is to use https://doc.dovecot.org/configuration_manual/authentication/auth_policy/or you can use passdb { driver = passwd-file deny = yes args = username_formar=%{rip} /etc/dovecot/deny.ip}or you can use https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… write this in Lua.Aki -------- Original message --------From: Hippo Man <hippoman(a)gmail.com> Date: 8/1/23 18:14 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Forcing imap authentication failure for certain IP addresses I'm running dovecot 2.3.18 under Debian 11.I want to do something that's a bit unusual: when IMAP connections are attemptedfrom a few specific IP addresses, I want to force an IMAP authentication failurefrom those connections, no matter what user ID and password are specified.I know that I can use iptables to completely block imap access from those IPaddresses to the IMAP ports. However, in these specific cases, I'd prefer thatthe connection goes through to dovecot, but for dovecot then to always generateauthentication failures for those specific connections ... even if a validuser ID and password happen to be specified.Is there a way to do this in dovecot?Thank you very much in advance.-- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

3 5

sieve passing body as arguments to executed script
by Jonathan Davis 02 Aug '23

02 Aug '23

I ran into an issue when trying to wildcard match the email body where the variable was empty, which lead me to extracttext and forverypart, however I am running into an odd error. When I deliver an email with the body of 'this is the body text of email' it dies with the following error: sogo: line 236: error: specified :args item `this is the body text of email??' is invalid The sieve in question: if header :matches "Subject" "*" { set "emailsubject" "${1}"; } if header :matches "From" "*" { set "emailfrom" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 80 "emailbody"; break; } } execute "script.php" ["${emailfrom}", "${emailsubject}", "${emailbody}"]; I tried downloading the log to see if ?? was a character not rendering correctly in console, but local text editors show the same. I'm not sure where it is coming from or what it is. I tried :quotewildcard with set :quotewildcard "quotedbody" ${emailbody}"; And passed "${quotedbody}" as an argument, however the same error was appearing in the logs. If I'm approaching this problem incorrectly, the end result is I want to pass the entire contents of the email to the script. - Jonathan

1 0

Postlogin script ACL_GROUPS from LDAP
by Andrzej Milewski 01 Aug '23

01 Aug '23

Hello, I am testing the Dovecot mail server with the iRedMail configuration. My backend is based on LDAP. I would like to set up the "Public" folders in such a way as to grant permissions to specific groups of users. To achieve this, I created the following entry in the configuration: acl = vfile:/etc/dovecot/dovecot-acl-global:cache_secs=300 For individual users, the global permissions work correctly, and I achieve what I want. However, I am unsure how to grant permissions for a group. Specifically, I know that I should include permissions for groups in this file, for example: Public/ anyone l Public/IT_Suwalki group=grupa1 lrwstipek Public/IT_Suwalki/* group=grupa1 lrwstipekxa But I don't know how to associate users with groups. From what I managed to figure out, the user should have the "ACL_GROUPS=grupa1,grupa2" variable, and it should be passed by the postlogin script. But how can I do that? Do you have any working example of such a script? Which LDAP attributes should this script utilize? In my LDAP, there is an attribute called "memberOfGroup"; can I use it? Thank you for all the suggestions. -- Andrzej Milewski andrzej.milewski(a)gmail.com tel. 0603957324

1 0