- dovecot - dovecot.org

Re: [Dovecot] Using checkpassword to block ips?
by Larry Ludwig 18 Jun '08

18 Jun '08

> ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 15 Jun 2008 19:04:05 -0400 > From: "Larry Ludwig" <larrylud(a)gmail.com> > Subject: [Dovecot] Using checkpassword to block ips? > To: <dovecot(a)dovecot.org> > Message-ID: <000601c8cf3c$1cd11130$0605a8c0@tank> > Content-Type: text/plain; charset="us-ascii" > > Hi new to the list, but we are a long time user of Dovecot > via DirectAdmin > control panel. > > We, like everyone else, are seeing an increase in dictionary > attacks of > POP/IMAP. We want to block them. > > I've searched the mailing list and found a few recommended > fail2ban, which > really won't work for our case. We need to do this over many > machines and > not one or two. We also like to gather info at the network > wide level. > Hackers know about attacking specific server/ips too often > and we've seen > much more distributed attacks that go under the radar of one server > monitoring setup. > > We've designed our own system and use a local RBL to > distribute the blocked > IPs. For ftp and ssh attacks it's worked very well. We > would like to use > the RBL to do the same with dovecot. > > >From my research it appears the best way to do this (and > only currently) is > with the checkpassword option. I haven't gotten it to work > yet. We have: > > passdb checkpassword { > args = /usr/local/bin/checkpassword > deny = yes > } > > As the first auth.. This should reject the connection if the > IP matches. > checkpassword can see TCPREMOTEIP enviornmental variable. > > In the checkpassword script we have: > > #!/usr/bin/perl > > sub read_uinfo { > my($user,$passwd,$apop_ts); > open X,"<&=3" or exit 111; > $_ = <X>; > # ugly; should use sysread instead > ($user,$passwd,$apop_ts) = /^(.*)\0(.*)\0(.*)\0/; > while (<X>) {}; > close X; > return ($user,$passwd,$apop_ts); > } > > ($user,$passwd,$apop_ts)=$debug?(shift,shift,shift):read_uinfo; > > $ipaddr=$ENV{TCPREMOTEIP}; > $result=system("/usr/sbin/checkdnsbl $ipaddr"); > if ( $result == 0) { > @ENV{"SHELL","USER","HOME"} = ($shell,$user,$home); > exit 0; > } > else { > exit 1; > } > > My questions are as follows: > - Can the deny = yes be used with checkpassword? > - What am I doing wrong with the script? It should reject only the > connections that are in the RBL. It blocks all > Bump.. No one can help with this setup or issue? -L -- Larry Ludwig Empowering Media 1-866-792-0489 x600 Managed and Unmanaged Xen VPSes http://www.hostcube.com/

1 0

[Dovecot] don't follow symlinks when creating mailbox list
by Dan Horák 18 Jun '08

18 Jun '08

Hi, this issue was discussed here twice in the not so far history (http://www.dovecot.org/list/dovecot/2008-January/028317.html, http://www.dovecot.org/list/dovecot/2008-February/029147.html) but I need to open it again as it makes problems for our users on one side and on the other side we don't want to diverge from the upstream sources in our packages. I agree with Timo that simply disabling the symlink following in creating the mailbox list can give a false sense of security so the question is whether a permanent solution can be developed and how it should look like? Regards, Dan -- Fedora and Red Hat package maintainer

3 3

[Dovecot] dovecot-uidlist cleanup
by Thomas Zajic 18 Jun '08

18 Jun '08

>From http://www.dovecot.org/list/dovecot/2008-June/031235.html: > > I have noticed that the entries in the dovecot-uidlist files don't seem > > to get updated when an email is deleted or moved to .Trash. It appears > > that this list list would just keep growing over time, being full of no > > longer used filenames, and must tend to increase its processing > > overhead. > > The deleted entries are removed when a new message arrives to the > mailbox. So it's just an optimization not to waste disk I/O on rewriting > the file when it's not necessary. If this isn't happening, there's > something wrong or you're misunderstanding something. >From http://www.dovecot.org/list/dovecot/2008-June/031403.html: > > However, I DO clobber the dovecot-uidlist in .Trash as part of my > > monthly housekeeping because it tends to get very large > > All the expunged messages get removed from it the next time a new > message is added to the mailbox. So there should be no need to delete > it. (v1.1 doesn't always recreate the file, but it gets rewritten if the > resulting file would be 70% of the current size or less.) If I understand this correctly, dovecot is supposed to clean out all deleted/expunged messages from dovecot-uidlist whenever a new message is added to the respective mailbox - right? This doesn't actually seem to be the case at least with dovecot-1.0: [root@airframe]:~# dovecot --version 1.0.14 [root@airframe]:~# [root@airframe]:~# du -h ~user/Maildir/.Trash/dovecot-uidlist 13M /home/user/Maildir/.Trash/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.Trash/dovecot-uidlist 289769 [root@airframe]:~# ls -1 ~user/Maildir/.Trash/cur/ | wc -l 14 [root@airframe]:~# [root@airframe]:~# du -h ~user/Maildir/.Logs.System\ Checks/dovecot-uidlist 3,5M /home/user/Maildir/.Logs.System Checks/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.Logs.System\ Checks/dovecot-uidlist 85188 [root@airframe]:~# ls -1 ~user/Maildir/.Logs.System\ Checks/cur/ | wc -l 16069 The only mailbox where this seems to work properly is INBOX: [root@airframe]:~# du -h ~user/Maildir/.INBOX/dovecot-uidlist 4,0K /home/user/Maildir/.INBOX/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.INBOX/dovecot-uidlist 18 [root@airframe]:~# ls -1 ~user/Maildir/.INBOX/cur/ | wc -l 17 [root@airframe]:~# The server runs sendmail, the LDA is procmail, not dovecot's deliver. The .procmailrc is empty except for the bare minimum, though, all other sorting is done either via Thunderbird message filters or manually: [root@airframe]:~# cat ~user/.procmailrc MAILDIR=$HOME/Maildir DEFAULT=.INBOX/ [root@airframe]:~# Any hints? Thanks, Thomas

3 5

[Dovecot] quota attribute for ldap.
by Mauro Sanna 18 Jun '08

18 Jun '08

I want to manage quotas and I want to manage quota limit with ldap. I use debian etch with slapd version 2.3 as ldap server. I see that in the schemas that comes with openLDAP debian distribution there are no quota attributes. How you have solved it?

1 0

[Dovecot] How to seperate pop3 and imap user lookup?
by Zhang Huangbin 18 Jun '08

18 Jun '08

Hi, all. I have two column in MySQL user table: - enablepop (NOT NULL default '1') - enableimap (NOT NULL default '1') How can i config dovecot to seperate pop user lookup and imap user lookup? Thanks very much. -- Best Regards. Zhang Huangbin - Mail Server Solution for Red Hat(R) Enterprise Linux & CentOS 5.x: http://rhms.googlecode.com/

2 3

[Dovecot] v1.1.rc10 released
by Timo Sirainen 18 Jun '08

18 Jun '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc10.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc10.tar.gz.sig v1.1.0 will be released on next Friday if nothing horrible happens. * LIST X-STATUS renamed to LIST STATUS and fixed its behavior with LIST-EXTENDED options. It's now compatible with STATUS-IN-LIST draft 00. - Message parsing could have sometimes produced incorrect results, corrupting BODY/BODYSTRUCTURE replies and perhaps others. - SORT: Fixed several bugs - FreeBSD 7.0: Environment clearing wasn't working correctly. This caused "environment corrupted" problems at least with deliver trying to call sendmail and running Dovecot from inetd. - HP-UX: Several fixes to get it to work (by Christian Corti) - Fixes to using expire plugin with SQL dictionary. - dbox fixes

6 5

[Dovecot] expire database
by Alfonso Sparano 17 Jun '08

17 Jun '08

Hi all I would like to know if there is function to force the load into the expire database of the old mails. I've enabled the function today (dovecot 1.1rc10) and I've a lot of old message that I think are not loaded automatically. What can I do? Thanks a Lot

2 1

[Dovecot] Mercurial repositories for ManageSieve and Sieve
by Stephan Bosch 17 Jun '08

17 Jun '08

Hello Dovecot users, Recently I was asked to use Mercurial for the ManageSieve development just like Dovecot. As a matter of fact I have been using Mercurial for some time now. Now that I am back from a short and active vacation I am ready to publish my repositories. The repositories are publicly available at: http://hg.rename-it.nl/ The -patch repositories are so-called Mercurial Queues (MQ) repositories. This provides an easy (quilt-like) means to manage patches over an upstream source repository like the one that exists for Dovecot. The patches are managed in a repository called 'patches' below the .hg directory in your main repository. Currently, these MQ repositories only have the managesieve.patch witch is the actual patch I refresh and release each time Timo makes a new Dovecot release. The following command sequence shows how to incorporate the managesieve patch repository in a freshly cloned dovecot-1.1 tree: hg clone http://hg.dovecot.org/dovecot-1.1 cd dovecot-1.1 hg clone http://hg.rename-it.nl/dovecot-1.1-managesieve-patch .hg/patches hg qpush When updating the dovecot tree it is important to unapply all patches before performing 'hg pull' on the dovecot tree: hg qpop --all hg pull hg update hg qpush This otherwise results in a multi-head situation which can be resolved using a 'hg rollback' or using 'hg qpop --all' afterwards, which should gracefully clean up the situation (never merge the heads!). Updating the patch repository works as follows: hg qpop --all hg -R .hg/patches pull hg -R .hg/patches update hg qpush After 'hg qpush' the dovecot repository is patched and can be compiled as explained for the normal patch method using the .diff.gz (don't forget ./autogen.sh for compiling dovecot in a mercurial repository). The actual ManageSieve implementation for Dovecot-1.1 is available as a separate package and thus there exists a separate repository for it. Its compilation is no different from the .tar.gz releases, except for the fact that (just like for dovecot) ./autogen.sh needs to be executed before configure. The new (and highly experimental) Sieve implementation is available as the dovecot-libsieve repository. It contains a README file that should explain most of its features and the installation procedure. This is currently still not release-ready and should not be used for any important mail whatsoever. I publish this for people who want to test and play around with it to provide feedback on early bugs and (release-critical) missing features. The TODO and README files provide an overview of my current progress towards a first release. Regards, Stephan.

1 0

[Dovecot] Re-applying Sieve rules on existing messages
by Tomasz K Jarzynka 17 Jun '08

17 Jun '08

Hi, I saw this hack on the Internet once but now that I need it, can't find it anymore. Does anybody know how to trick Dovecot LDA/Sieve into filtering mail that has already been stored into a folder? Thanks in advance ;) -- Tomasz K. Jarzynka / +48 601 706 601 / tomee(a-t)genesilico(d-o-t)pl Laboratory of Bioinformatics and Protein Engineering | www.genesilico.pl International Institute of Molecular and Cell Biology | www.iimcb.gov.pl

2 1

[Dovecot] quota-warning.sh
by Drew Marshall 17 Jun '08

17 Jun '08

Hi I have just installed Dovecot (Moved from Courier-IMAP) and have just about everything running well thanks to some great docs in the wiki (Thank you to all those who contributed!) however I have not managed to get the quota warnings working yet. I have done much Googling and come back with some oldish posts which help me to understand how the quota warnings work but having looked at all this I have realised I don't have a quota-warning.sh script in /usr/local/bin where the config suggests it ought to be. In fact, I don't have a file by this name any where on the box. I have downloaded both 1.1 source (Which I'm running) and 1.0 and I can't find this anywhere in the sources or the tarball. Could some one tell me where I can find this or am I supposed to make my own? If so is there and example that I can follow? Thanks in advance for your help Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by Technology Tiger's Mail Launder system <www.mail-launder.com> Our email policy can be found at www.technologytiger.net/policy Technology Tiger Limited is registered in Scotland with registration number: 310997 Registered Office 55-57 West High Street Inverurie AB51 3QQ

2 2