- dovecot - dovecot.org

[Dovecot] dovecot-ldap : can't find user in OU subtree
by me＠electronico.nc 31 Oct '13

31 Oct '13

Hi all, Well, I've compiled and installed dovecot 2.2.6 with following options: > ./configure --prefix=/usr/ --sysconfdir=/etc/ --with-mysql > --libexecdir=/usr/lib/ --localstatedir=/var > --with-moduledir=/usr/lib/dovecot/modules --disable-rpath > --disable-static --with-zlib --with-bzlib --with-solr --with-ldap > --with-gssapi --with-nss doveconf -n: > # 2.2.6: /etc/dovecot/dovecot.conf > # OS: Linux 3.8.0-32-generic x86_64 Ubuntu 12.04.3 LTS ext4 > auth_debug = yes > auth_mechanisms = plain login > auth_verbose = yes > first_valid_gid = 20001 > first_valid_uid = 20001 > log_timestamp = %Y-%m-%d %H:%M:%S > mail_debug = yes > mail_gid = 20001 > mail_home = /media/data/email/%n > mail_location = maildir:/media/data/email/%n/mail > mail_plugins = fts fts_solr acl zlib mail_log notify > mail_uid = 20001 > managesieve_notify_capability = mailto > managesieve_sieve_capability = comparator-i;octet > comparator-i;ascii-casemap fileinto reject envelope encoded-character > vacation subaddress comparator-i;ascii-numeric relational regex > imap4flags copy include variables body enotify environment mailbox > date spamtest spamtestplus virustest > namespace { > list = no > location = > maildir:/media/data/email/%%n/mail:INDEX=/media/data/email/%n/mail/shared/%%n > prefix = shared/%%n/ > separator = / > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = maildir:/media/data/email/%n/mail > mailbox Sent { > auto = subscribe > } > mailbox Spam { > auto = subscribe > } > mailbox SpamFalse { > auto = subscribe > } > mailbox SpamToLearn { > auto = subscribe > } > prefix = > separator = / > type = private > } > passdb { > args = /etc/dovecot/dovecot-ldap-passdb.conf.ext > driver = ldap > } > plugin { > acl = vfile > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename save mailbox_create > mail_log_fields = uid box msgid size > sieve = /media/data/email/%n/dovecot.sieve > sieve_after = /media/data/email/sieve/global.sieve > sieve_dir = /media/data/email/%n/sieve > zlib_save = bz2 > zlib_save_level = 9 > } > protocols = imap pop3 sieve lmtp > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0660 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0640 > user = vmail > } > } > service imap-login { > inet_listener imap { > address = * > port = 143 > } > inet_listener imaps { > address = * > port = 993 > ssl = yes > } > process_limit = 256 > } > service lmtp { > inet_listener lmtp { > address = * > port = 24 > } > user = vmail > } > service managesieve-login { > inet_listener sieve { > address = * > port = 4190 > } > process_limit = 256 > vsz_limit = 64 M > } > service pop3-login { > inet_listener pop3 { > address = * > port = 110 > } > inet_listener pop3s { > address = * > port = 995 > ssl = yes > } > } > ssl = required > ssl_ca = </etc/postfix/tls/cacert.pem > ssl_cert = </etc/postfix/tls/radiodjiido-cert.pem > ssl_key = </etc/postfix/tls/radiodjiido-key.pem > ssl_verify_client_cert = yes > userdb { > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > driver = ldap > } > protocol imap { > imap_client_workarounds = delay-newmail > imap_max_line_length = 64 k > mail_max_userip_connections = 20 > mail_plugins = acl imap_acl mail_log notify zlib > } > protocol pop3 { > mail_plugins = zlib mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } > protocol sieve { > managesieve_logout_format = bytes ( in=%i : out=%o ) > } > protocol lda { > info_log_path = > log_path = > mail_plugins = sieve zlib mail_log notify > quota_full_tempfail = yes > syslog_facility = mail > } > protocol lmtp { > info_log_path = > log_path = > mail_plugins = sieve fts zlib mail_log notify > quota_full_tempfail = yes > } /etc/dovecot/dovecot-ldap-passdb.conf.ext: > hosts = localhost > auth_bind = yes > auth_bind_userdn = cn=%u,OU=users,dc=domain,dc=lan > ldap_version = 3 > base = ou=users,dc=domain,dc=lan > scope = subtree > pass_filter = (&(objectClass=person)(cn=%u)(mail=*)) /etc/dovecot/dovecot-ldap-userdb.conf.ext: > hosts = localhost > dn = cn=ldap,cn=Users,DC=domain,DC=lan > dnpass = My_secret_pass > ldap_version = 3 > base = OU=users,DC=domain,DC=lan > scope = subtree > user_attrs = uid=20001, gid=20001, home=/media/data/email/%n, > mail=/media/data/email/%n/mail > user_filter = (&(objectClass=person)(cn=%n)(mail=*)) > iterate_attrs = cn=user > iterate_filter = (objectClass=person) All seems to work as expected up-to-now, but : If I move a user from OU 'users' to a sub-OU 'administrative' on Active Directory : -> The user can't login anymore to Dovecot I have added the "scope = subtree" to the userdb and passdb files but it doesn't change anything. Here is the debug part when user test3 (located in ou=users, ou=administrative) tries to login: > Oct 30 18:49:12 serveur dovecot: auth: Debug: auth client connected > (pid=4292) > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=L6uskfDpKwAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54827 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:49:12 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:49:12 serveur dovecot: auth: > ldap(test3,10.10.20.208,<L6uskfDpKwAKChTQ>): invalid credentials > Oct 30 18:49:14 serveur dovecot: auth: Debug: client passdb out: > FAIL#0111#011user=test3 As soon as I move user 'test3' back to ou=users, it can login ... > Oct 30 18:53:57 serveur dovecot: auth: Debug: Loading modules from > directory: /usr/lib/dovecot/modules/auth > Oct 30 18:53:57 serveur dovecot: auth: Debug: Read auth token secret > from /var/run/dovecot/auth-token-secret.dat > Oct 30 18:53:57 serveur dovecot: auth: Debug: auth client connected > (pid=4303) > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: > AUTH#0111#011PLAIN#011service=imap#011secured#011session=h+ypovDpUAAKChTQ#011lip=10.10.20.1#011rip=10.10.20.208#011lport=993#011rport=54864 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > CONT#0111#011 > Oct 30 18:53:57 serveur dovecot: auth: Debug: client in: CONT<hidden> > Oct 30 18:53:57 serveur dovecot: auth: Debug: client passdb out: > OK#0111#011user=test3 Thanks in advance for your time and lights. Nicolas

3 5

[Dovecot] IMAP Dovecot unknown namespace creating root folders
by marcus lively 31 Oct '13

31 Oct '13

Hi, I hope someone can point me in the right direction here. I am migrating a mailbox from a non cPanel server, and the mailboxes have folders which seem to be at the same level as the Inbox. The users access these mailboxes using IMAP. The new server configuration is Exim > Dovecot 1.2.17 > Maildir with the standard cPanel install settings. dovecot -n output below I have created the new mailbox within cPanel however when I try to create a 'top level' folder in Outlook I receive the error 'Cannot create the folder: Unknown namespace' (Note I also tried this with the windows mail client to ensure it was not client side) I know that I can get round this by setting the root folder path on the client to 'Inbox' and therefore the folders would be created as sub-folders of Inbox, and this would not be visible to the user, but I was hoping to migrate without touching the clients. Should dovecot report the default root folder path automatically, or create a default top level namespace for each user so this can be done, or could I have just gone wrong and missed something. Any advice on getting this working appreciated, thanks for any help Maspry # 1.2.17: /etc/dovecot.conf # OS: Linux 2.6.32-71.el6.x86_64 x86_64 CentOS release 6.4 (Final) protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/dovecot/ssl/dovecot.crt ssl_key_file: /etc/dovecot/ssl/dovecot.key ssl_cipher_list: ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login login_process_per_connection: no login_processes_count: 2 login_max_processes_count: 50 login_max_connections: 500 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 3 maildir_copy_preserve_filename: yes mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): acl quota imap_quota mail_plugins(imap): acl quota imap_quota mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib64/dovecot/imap mail_plugin_dir(imap): /usr/lib64/dovecot/imap mail_plugin_dir(pop3): /usr/lib64/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): UID%u-%v pop3_logout_format(default): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(imap): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_logout_format(pop3): top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster(a)example.com auth default: mechanisms: plain login cache_size: 1024 username_chars: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$-=?^_{}~./@+% passdb: driver: checkpassword args: /usr/local/cpanel/bin/dovecot-auth userdb: driver: prefetch socket: type: listen client: path: /var/run/dovecot/auth-client mode: 438 plugin: quota: maildir quota_rule: Trash:ignore acl: vfile

2 2

Re: [Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 30 Oct '13

30 Oct '13

Currently our dovecot servers are on our webhosting linux boxes. We are using the LAMP stack to host websites, and also doing email with postfix & dovecot on these systems. We provide this as a hosting setup for 100+ accounts/websites on a single server (a multi-tenant setup). Each customer has anywhere between 1-100 email accounts which Dovecot services. If a customer has vulnerable PHP code on a website, some of these will allow a remote file upload. I have seen cases where they upload a PHP script that is a sort of web-based console/shell to the server (file-system, etc.). It provides several tools which all run through the uploaded PHP script to try to brute force and do other attacks. I've seen attempts at a root exploit. We've never had a root exploit and any such case of a customer's site being hacked has been easily contained by simple filesystem permissions being correct (and the fact that we have apache setup to run all scripts as the user who is the owner of the script files, which confines the script to that users' permissions). Still nobody loves the idea of bad guys trying to hack on your box. So.... given that type of scenario, if filesystem permissions weren't correct, or some new exploit surfaced that allowed someone bypass or elevate to root, then they could theoretically have access to the entire fileystem including where emails are stored. I hope to never have this sort of thing happen. We patch our systems regularly and have other security measures we follow to prevent this. We also are managing most of the PHP scripts customers use ourselves now and are updating those for the CMS' and other systems proactively. However, it would be nice to know that even if we were breached, the emails on the server were encrypted and would be completely useless to an attacker. This type of encryption is ideal and some regulations prefer (although don't require) it. - Doug Mortensen Network Consultant Impala Networks P: 505.327.7300 -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Michael Orlitzky Sent: Monday, October 28, 2013 11:52 AM To: dovecot Subject: Re: [Dovecot] Encryption solution for messages at rest On 10/28/2013 12:02 PM, Douglas Mortensen wrote: > Hi, > > We have clients with various security & compliance requirements. > Although not required, it would be ideal to have messages encrypted at > rest. You can rule out a lot of the crazier options by answering the questions, (a) What attack scenario do you have in mind? (b) How will encryption help?

11 15

[Dovecot] Right values for Antispam plugin
by Michael Neurohr 30 Oct '13

30 Oct '13

Hi! I'm currently configuring the Dovecot Antispam plugin for the use with Dspam. In general it works, but I'm not sure about one special config parameter: antispam_dspam_args At the moment I set it to: antispam_dspam_args = --source=error;--signature=%%s;--user;%u Is that the appropriate value for retraining? I'm not sure if "%%s" is correct to get the signature value. I was not able to find any documentation that describes that value. So I just want to know if my plugin config is correct for retraining. plugin { antispam_backend = dspam antispam_spam = Spam antispam_trash = trash;Trash;Deleted Items;Deleted Messages antispam_signature = X-DSPAM-Signature antispam_signature_missing = move antispam_dspam_binary = /usr/bin/dspam antispam_dspam_args = --source=error;--signature=%%s;--user;%u } Thanks, Michael

1 0

Re: [Dovecot] Encryption solution for messages at rest
by Douglas Mortensen 30 Oct '13

30 Oct '13

So I suppose you're not a fan of the email hosting systems on the planet that bundle many services onto 1 box. Thanks for the feedback. - Doug Mortensen Network Consultant Impala Networks P: 505.327.7300 -----Original Message----- From: dovecot-bounces(a)dovecot.org [mailto:dovecot-bounces@dovecot.org] On Behalf Of Alan Brown Sent: Tuesday, October 29, 2013 10:05 AM To: dovecot Subject: [Dovecot] Encryption solution for messages at rest > Date: Tue, 29 Oct 2013 08:54:04 +0100 > From: Robert Schetterer <rs(a)sys4.de> > To: dovecot(a)dovecot.org > Subject: Re: [Dovecot] Encryption solution for messages at rest > Message-ID: <526F699C.9080402(a)sys4.de> > Content-Type: text/plain; charset=ISO-8859-1 > > > you shouldnt host mail/imap services on the same servers with massive > http hosting, You shouldn't host anything else on a webserver FULLSTOP. Webservers are best treated as "disposable" and should be heavily sandboxed. Any resources they can use should be vetted and ideally set as "read only" Inbound external access should be firewalled down to the webserver ports and OUTBOUND traffic should be firewalled too (If it has no business initiating external connections then block all SYNs), in order to stop it becoming a DDoS zombie. It's foolish (at best) to have mail servers running on a webserver, because if it's compromised it can immediately be used as a spam engine without much further effort. At least if it has to hand mail off to another mailserver you have a chance to run outbound filtering on the emitted mail without worrying about that being compromised too.

1 0

[Dovecot] separate mail_location for system and normal users
by Andrzej A. Filip 30 Oct '13

30 Oct '13

How to configure dovecot to use different default mail_location for system (uid<1_000) and normal users (uid>=1_000)? I want to to use by default * classic mailbox in standard location for system users * maildir in $HOME subdirectory for normal users

2 3

[Dovecot] Disable unsecure POP3 at all (Dovecot 2.1)
by Андрей Кумыков 29 Oct '13

29 Oct '13

Hi to all. Is it possible to disable unsecure POP3 protocol at all in Dovecot 2.1? There was "protocols" option in 1.x version, and there was separate pop3 and pop3s modules. There is no "pop3s" in configuration files in 2.1.

3 2

[Dovecot] Problem with dovecot-lda
by Wolfgang Ganzert 29 Oct '13

29 Oct '13

Hello Ladies and Gentlemen, first of all I have to say that dovecot is really impressive. I seems to be a very goot IMAP server and has in general a good documentation. I'm a beginner regarding the administration so please excuse if my questions sound silly but I want to learn to administrate these sophisticated things. Now here's my configuration: Linux openSuSE 12.1 Postfix 2.8.8 Dovecot 2.0.16 Boundary condition: Postfix as smtp (Postfix is configured as relay server; mail is sent to smtp.web.de if mail is not locally distributed) Dovecot as IMAP server in my private network (192.168....) Situation: I want to store outgoing mail which is send by postfix also in a "SENT" folder in Dovecot. The SENT folder is available and created through the plugin "autocreate". The main.cf file from postfix contains the following mailbox command: mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -m SENT If I send a simple mail from the shell with the following command echo "Hello me" | mail -s "Dovecot test 50, shell nach SENT" $USER the mail is send to my mailbox and stored in the folder "SENT" as unread. Problem: 1. I would expect to have to mails coming in; one in my "SENT" folder because this is copy of the mail and another one which is the incoming folder because the mail was sent to me. But, there is no mail in the incoming folder. 2. If I use a mail client like kmail2 the same thing happens. The mail is distributed to the SENT folder but there's no copy in the incoming folder. 3. If I send a mail to my adress at @web.de with the postfix configuration from above I do not receive the mail at web.de. 4. If I send a mail to my adress at @web.de with a postfix simplified mailbox command NOT containing the mailbox with "-m", then mail is send to web.de and there I receive it in the incoming box. This is the simplified command: mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" Summary: All examples from above show that I do not get a COPY of the outgoing mail in my "SENT" folder but it's the REAL mail. Can You please give me some advice what to do? Thank You! Wolfgang P.S.: In /var/log/mail and /var/log/dovecot.log I do not get any errors.

2 1

[Dovecot] Building the Antispam plugin fails
by Michael Neurohr 29 Oct '13

29 Oct '13

Hi! I'm running Dovecot 2.2.5 on a CentOS 6.4 server from the ATRPMs repository. Unfortunately this repo does not provide a packaged version of the Antispam Plugin. So I followed the steps outlined in the Dovecot Wiki [1]. But when running the command ./configure, I get stuck with the following error: checking for dovecot-config in "/usr/local/lib/dovecot"... not found configure: configure: Use --with-dovecot=DIR to provide the path to the dovecot-config file. configure: error: dovecot-config not found So I downloaded the dovecot-devel package and run the configure command again with the following command: ./configure --with-dovecot=/usr/include/dovecot but with the same result. I made sure the the directory "/usr/include/dovecot" does contain the Dovecot header files. What can I do next? Do I really also have to install Dovecot from the sources only to get the Antispam Plugin working? Thanks, Michael [1] http://wiki2.dovecot.org/Plugins/Antispam

2 2

[Dovecot] Encryption solution for messages at rest
by Alan Brown 29 Oct '13

29 Oct '13

> Date: Tue, 29 Oct 2013 08:54:04 +0100 > From: Robert Schetterer <rs(a)sys4.de> > To: dovecot(a)dovecot.org > Subject: Re: [Dovecot] Encryption solution for messages at rest > Message-ID: <526F699C.9080402(a)sys4.de> > Content-Type: text/plain; charset=ISO-8859-1 > > > you shouldnt host mail/imap services on the same servers with massive > http hosting, You shouldn't host anything else on a webserver FULLSTOP. Webservers are best treated as "disposable" and should be heavily sandboxed. Any resources they can use should be vetted and ideally set as "read only" Inbound external access should be firewalled down to the webserver ports and OUTBOUND traffic should be firewalled too (If it has no business initiating external connections then block all SYNs), in order to stop it becoming a DDoS zombie. It's foolish (at best) to have mail servers running on a webserver, because if it's compromised it can immediately be used as a spam engine without much further effort. At least if it has to hand mail off to another mailserver you have a chance to run outbound filtering on the emitted mail without worrying about that being compromised too.

1 0