- dovecot - dovecot.org

Re: [Dovecot] POP3 dictionary attacks
by Bruce Bodger 16 Aug '08

16 Aug '08

On Aug 16, 2008, at 11:14 AM, Mark Sapiro wrote: >>> Exactly. These days, IP spoofing is most useful to hide the >>> identity of >>> the perpetrator of a DoS attack. It certainly is not applicable to a >>> dictionary attack on POP3 or other logins since with a spoofed >>> IP, the >>> perpetrator will never see the response to determine if the login >>> attempt was successful. >> >> I stand corrected... sorry. I was thinking of an http cross-site >> attack which also seems popular now-a-days. >> >> So if I read you right then you would consider the IP address shown >> in the original thread post.. >> >>> dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >> >> >> ..216.31.146.19, to be a party to the attack and therefore a >> candidate for locking out? > > > Yes. I do it (with my own script, not fail2ban, but it works the same > way). Thank you for the clarification. B. Bodger

1 0

[Dovecot] PAM session closes too soon
by Lauri Alanko 16 Aug '08

16 Aug '08

Hi. I'm trying to keep most of my data encrypted when possible, only keeping the decryption key in memory (and thus vulnerable to local attacks) when I'm actually using my data. In practice, this means using pam_mount to mount my home directory from an encrypted device. It almost looked like I could get this to work with mail as well, even when read via IMAP from a remote client: I placed my mail in the encrypted home directory, added pam_mount to /etc/pam.d/dovecot, and set session=yes in Dovecot's PAM configuration. Except that it didn't, quite: pam_mount worked just fine and mounted the encrypted disk using the IMAP password... and then immediately unmounted it, since for some reason session=yes means that Dovecot closes the session _immediately_ after opening it. This seems just silly. If a PAM session is to be used, then it seems obvious to me that its length should be exactly the length of the IMAP session. I can't see any reason for the current behavior, except maybe that it was a bit simpler to code and is sufficient for pam_mkhomedir (and only that). Can this be fixed with reasonable effort? Also, for pam_mount to work correctly, there must not be any file descriptors open in the mounted file system when the session closes, as otherwise unmounting is impossible. Will dovecot release all fds into the mail and index files when the session ends, or can it be made to do so? (UTSL is an acceptable answer.) Thanks in advance. Lauri Alanko la(a)iki.fi

2 1

[Dovecot] Error 89
by Hodges 16 Aug '08

16 Aug '08

Just installed dovecot 1.1.2. downloaded from dovecot.org. Seemed to compile and install OK but I get the following error when I try to start it "child 28410 (auth) returned error 89 (fatal failure)" I just want to use it for SMTP/SASL authorization, not Pop3 or IMAP, as yet It looks as though I haven't installed some component or other but what? Config file follows; # 1.1.2: /usr/local/etc/dovecot.conf protocols: none login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Steve

2 2

[Dovecot] Problem with squirrelmail and dovecot 1.1
by Gerhard Wiesinger 16 Aug '08

16 Aug '08

Hello! I'm running squirrelmail 1.4.8 (I know this is not the latest version) and know I'm having troubles with: 1.) Folder list view 2.) Save to sent or Drafts folder. Configuration worked well. I think it has to do with the upgrade from dovecot 1.0 to 1.1 and the LIST command. Thunderbird/alpine work well. Commands from rawlog are: A002 LIST "" "~/Mail/Drafts" A002 OK List completed. or A002 LIST "" "~/Mail/sent" A003 CREATE "~/Mail/sent" A002 OK List completed. A003 NO Mailbox exists. Has something changed in the folder behaviour of dovecot from 1.0 to 1.1? If you need more information please let me know it. Any ideas? Thnx. Ciao, Gerhard -- http://www.wiesinger.com/

1 0

Re: [Dovecot] SpamAssassin and Maildir with Dovecot
by Gabriel Millerd 15 Aug '08

15 Aug '08

On Fri, Aug 15, 2008 at 11:57 AM, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > A patch has been proposed for SpamAssassin to process Maildir folders of > spam: > Nothing on the disk looks modified by the code change, sa-learn is just reading from the disk fand altering the sa-storage as instructed by the learn rule switch. If you learned and then nuked some headers for example, the file size would change and that would be an issue if you storage that in the filename (they wouldn't match) as well as the dovecot index for imap/pop would be off potentially. Possibly some active imap sessions might be confused as well. This patch only really is sensitive to the Maildir structure, it has been able to handle the mail directories. -- Gabriel Millerd

1 0

[Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, this may be an obvious logical problem I'm not aware of, which cannot be solved any more efficiently... but maybe it's just a bug or there is potential for optimisation in Dovecot (or Thunderbird?). When searching for multiple terms at once ("any of") with Thunderbird/Dovecot (using FTS Squat indexes), it takes much longer (not double the time, or a bit more than that, but really much, much longer) than when I search for only one term. Here are some figures (the IMAP commands are shown as issued by Thunderbird and recorded by Dovecot rawlog). While searching, I can see the 'imap' process using 100% CPU time. Searching for "xyz" in Archive and subfolders 4 secs 32 select "Archive" 33 uid SEARCH UNDELETED BODY "xyz" 34 select "Archive.2004" 35 UID fetch 1:* (FLAGS) 36 uid SEARCH UNDELETED BODY "xyz" 37 select "Archive.2004.2005" 38 UID fetch 1:* (FLAGS) 39 uid SEARCH UNDELETED BODY "xyz" 40 select "Archive.2004.2005.2006" 41 UID fetch 1:* (FLAGS) 42 uid SEARCH UNDELETED BODY "xyz" 43 select "Archive.2004.2005.2006.2007" 44 UID fetch 1:* (FLAGS) 45 uid SEARCH UNDELETED BODY "xyz" 46 select "Archive.2004.2005.2006.2007.2008" 47 UID fetch 1:* (FLAGS) 48 uid SEARCH UNDELETED BODY "xyz" 49 IDLE Searching for "xyz" and "abc" (any of) in Archive and subfolders 123 secs 50 select "Archive" 51 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 52 select "Archive.2004" 53 UID fetch 1:* (FLAGS) 54 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 55 select "Archive.2004.2005" 56 UID fetch 1:* (FLAGS) 57 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 58 select "Archive.2004.2005.2006" 59 UID fetch 1:* (FLAGS) 60 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 61 select "Archive.2004.2005.2006.2007" 62 UID fetch 1:* (FLAGS) 63 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 64 select "Archive.2004.2005.2006.2007.2008" 65 UID fetch 1:* (FLAGS) 66 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 67 IDLE Searching for "xyz", "abc" and "def" in Archive and subfolders 173 secs 68 select "Archive" 69 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 70 select "Archive.2004" 71 UID fetch 1:* (FLAGS) 72 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 73 select "Archive.2004.2005" 74 UID fetch 1:* (FLAGS) 75 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 76 select "Archive.2004.2005.2006" 77 UID fetch 1:* (FLAGS) 78 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 79 select "INBOX" 80 UID fetch 1:* (FLAGS) 81 check 82 select "Archive.2004.2005.2006.2007" 83 UID fetch 1:* (FLAGS) 84 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 85 select "Archive.2004.2005.2006.2007.2008" 86 UID fetch 1:* (FLAGS) 87 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 88 IDLE Searching for "xyz", "abc", "def" and "ghi" in Archive and subfolders 217 secs 89 select "Archive" 90 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 91 select "Archive.2004" 92 UID fetch 1:* (FLAGS) 93 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 94 select "Archive.2004.2005" 95 UID fetch 1:* (FLAGS) 96 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 97 select "Archive.2004.2005.2006" 98 UID fetch 1:* (FLAGS) 99 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 100 select "Archive.2004.2005.2006.2007" 101 UID fetch 1:* (FLAGS) 102 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 103 select "Archive.2004.2005.2006.2007.2008" 104 UID fetch 1:* (FLAGS) 105 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 106 IDLE Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFIooxq7yMg/OiDoAURAhb9AJ4jOaK+eHXcSwJTAER8xEKIlJJt0gCgtZan wJm05V0F03gj+6YxbNOtCew= =jID/ -----END PGP SIGNATURE-----

5 5

[Dovecot] Migrating mbox to maildir
by Mike Hobbs 15 Aug '08

15 Aug '08

Sorry to bother everyone but I was wondering if it is possible for Dovecot to handle mbox AND maildir at the same time? Example: I want to convert from UW Imap using mbox to Dovecot using maildir. Do I need to convert ALL my users mbox mailboxes to maildir right away or can I convert them one at a time? I'd like to use maildir with all my new users, but I'd like to be able to continue using mbox for my old users and slowly convert them as I get time. Is this possible? I know Dovecot supports both formats, I just couldn't find anything in the install notes about using both at the same time. Thank you, mike

3 2

[Dovecot] Webmail app ... again.
by Roderick A. Anderson 15 Aug '08

15 Aug '08

There was a thread several weeks (or months) ago on webmail applications. I didn't like any of the options and only found few that I did but they were either expensive or not maintained. So ... I raised the question on the Catalyst Framework list about Perl based webmail apps and got nothing usable. It came down to what would it take to build a Perl (Cat) webmail app. Several others on the list got interested so we decided to build it. The main issue I run into is my lack of understanding of the ins-and-outs of the IMAP specification and the features that come with using Dovecot. (Oh yeah. Dovecot was the preferred IMAP server!) Another project I'm working on uses IMAP and what I found was there is a great quantity of Perl modules for dealing with IMAP. A great quantity! Unfortunately many of them assume a deeper knowledge of IMAP than I have so are very confusing. What I'm looking for is a good reference, besides the RFC, on IMAP. Anything out there? Electronic or dead-tree is fine. (A book of Dovecot would be neat too.) TIA, Rod --

10 17

Re: [Dovecot] Marking as Read causes Body.Peek on ALL messages - Reasonable?
by Daniel Watts 15 Aug '08

15 Aug '08

>> I've noticed when I select a folder of messages (Thunderbird) and >> mark them all as read (or unread) it produces the following IMAP >> transcript: >> >> Source Destination Info >> c.c.c.c s.s.s.s Request: DONE >> s.s.s.s c.c.c.c Response: 20 OK Idle completed. >> c.c.c.c s.s.s.s Request: 21 uid store 1:20 -Flags (\Seen) >> s.s.s.s c.c.c.c Response: * 1 FETCH (UID 1 FLAGS (\Recent >> NonJunk)) >> c.c.c.c s.s.s.s Request: 22 UID fetch 2 (UID RFC822.SIZE >> BODY.PEEK[]) >> s.s.s.s c.c.c.c Response: * 2 FETCH (UID 2 RFC822.SIZE 1339 >> BODY[] {1339} > .. > > Looks a bit stupid. But I'd guess it's related to Thunderbird being > configured to download mail when reading it and it treats setting > \Seen the same as reading it. Just a guess though. It becomes a bit of a problem when done in a folder of 40,000 messages - locks up the program for ages and hammers the server a bit too. > >> Is this reasonable? I thought it would be possible to just send a >> list of message UIDs and say mark these as /seen /unseen etc. > > Sure, it would be possible. Also if Thunderbird really wants to fetch > these messages' bodies, it could have done it using a single command > instead of 20 separate ones.. > Perhaps it does it one by one incase there are a lot of messages.... but it could chunk them at least. Timo - thanks as always for your help with this, particularly as it is slightly OT. Ever thought about writing your own mail client? =) Perhaps LightningDove! The more I use Thunderbird the more I find it totally insane. Still better than going back to Outlook (thought not tried 2007 yet). Dan

2 2

[Dovecot] Request queue is full
by Raphael Bittencourt S. Costa 14 Aug '08

14 Aug '08

Hello all, Today I had problems on one of the servers. Dovecot stopped working and I got lots of "Request queue is full" on logs. Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxx(a)xxx.com.br): Request queue is full Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxxxx(a)xxxx.com.br): Request queue is full Aug 14 16:49:45 mailserver03 dovecot: auth(default): ldap(xxxx(a)xxxxx.com,10.0.3.1): Request queue is full Only after a restart on dovecot daemon the services worked again. Does anyone know how can I fix this problem? The server were with about 900 imap connections and 300 pop3 connections. # 1.1.1: /etc/dovecot//dovecot.conf syslog_facility: local1 protocols: imap pop3 ssl_disable: yes disable_plaintext_auth: no shutdown_clients: no login_dir: /usr//var/run/dovecot/login login_executable(default): /usr//libexec/dovecot/imap-login login_executable(imap): /usr//libexec/dovecot/imap-login login_executable(pop3): /usr//libexec/dovecot/pop3-login login_process_per_connection: no login_greeting_capability(default): yes login_greeting_capability(imap): yes login_greeting_capability(pop3): no login_process_size: 128 login_processes_count: 30 login_max_processes_count: 1024 login_max_connections: 512 max_mail_processes: 10240 mail_max_userip_connections(default): 20 mail_max_userip_connections(imap): 20 mail_max_userip_connections(pop3): 10 mail_uid: 1033 mail_gid: 1033 mail_location: maildir:%h/Maildir mail_executable(default): /usr//libexec/dovecot/imap mail_executable(imap): /usr//libexec/dovecot/imap mail_executable(pop3): /usr//libexec/dovecot/pop3 mail_plugins(default): quota imap_quota autocreate mail_plugins(imap): quota imap_quota autocreate mail_plugins(pop3): quota mail_plugin_dir(default): /usr//lib/dovecot/imap mail_plugin_dir(imap): /usr//lib/dovecot/imap mail_plugin_dir(pop3): /usr//lib/dovecot/pop3 pop3_no_flag_updates(default): no pop3_no_flag_updates(imap): no pop3_no_flag_updates(pop3): yes pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %f pop3_client_workarounds(default): pop3_client_workarounds(imap): pop3_client_workarounds(pop3): outlook-no-nuls namespace: type: private prefix: INBOX. inbox: yes list: yes subscriptions: yes auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: prefetch userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen master: path: /var/run/dovecot/auth-master mode: 438 plugin: quota: maildir quota_rule: *:bytes=10240 quota_rule2: *:messages=30000 quota_rule3: Trash:bytes=10%% autocreate: SPAM.E Spam autocreate2: SPAM.Marcar Spam autocreate3: SPAM autocreate4: SPAM.Desmarcar Spam []s, Raphael Costa

1 0