- dovecot - dovecot.org

[Dovecot] [OT] Is there a secure reverse IMAP proxy
by Sven Kirmess 25 Apr '04

25 Apr '04

This question is off topic. I ask this list because the question is related to security and IMAP and I guess the people in this list know a lot about both of that. Is there a secure reverse proxy for the IMAP protocol? Something you can install on a bastion host which checks the IMAP traffic before forwarding it to the internal IMAP server? There are these proxies for WebMail to IMAP connections but as far as I can tell they were not created for security reasons and not with security as primary goal. Sven

3 2

[Dovecot] SSL Ciphers
by John Wentworth 25 Apr '04

25 Apr '04

I have dovecot running as a pop3s server on port 995 it works great with sendmail and I run nessus to check security issues nessus reports this The SSLv2 server offers 3 strong ciphers, but also 0 medium strength and 2 weak "export class" ciphers. The weak/medium ciphers may be chosen by an export-grade or badly configured client software. They only offer a limited protection against a brute force attack Solution: disable those ciphers and upgrade your client software if necessary I have previously disabled weak ciphers in apache but cannot figure out how to disable the weak ciphers in dovecot Any help would be appreciated john

2 1

[Dovecot] problems with squirrelmail and TLS (debian unstable)
by Amelia A Lewis 25 Apr '04

25 Apr '04

Heylas, So, okay, I've had this lovely IMAP server running, and adore the ease of configuration, among other things. Problem, though. I'm trying to set up SquirrelMail, so that some folks with accounts on my box can use it without having to set up a proper imap client (or can check mail when they're at a cafe, or like that). However, I *won't* turn off the disable_plaintext_auth, 'cause I'm damned if I'll set up a box that asks people to send passwords in the clear, and there *are* people using imap. Dovecot cannot, currently, be configured to permit plaintext on localhost while requiring Something Better from the rest of the world. This becomes a problem with SquirrelMail, which can't cope with TLS. It just barfs. Looking at bug reports in debian, this has already been noticed, and the maintainer there (and the maintainers of SquirrelMail) considers this a non-problem, 'cause, they say, you shouldn't be using TLS with webmail. Is there a way to set up, for instance, two instances of dovecot, running on different ports, so that one listens to the external interface and the other listens to localhost? I don't much like the idea, but how would I go about doing this? Two copies of dovecot.conf and a command-line switch? Amy! -- Amelia A. Lewis amyzing {at} talsever.com Yankees are compelled by some mysterious force to imitate Southern accents and they're so damn dumb they don't know the difference beween a Tennessee drawl and a Charleston clip. -- Rita Mae Brown, "Rubyfruit Jungle"

4 4

[Dovecot] error dropping root group priv
by Thomas Abthorpe 24 Apr '04

24 Apr '04

Good morning all, I am new to this list. I have been running FreeBSD 5.1 with dovecot successfully for about a year. Just recently, I built a new machine with 5.2.1-p5 on the Intel platform with dovecot-0.99.10.4_2. When I use the same configuration options on the new machine, I get Apr 24 10:53:59 standrew pop3-login: Login: tabthorpe [172.16.1.100] Apr 24 10:53:59 standrew pop3(tabthorpe): We couldn't drop root group privileges Apr 24 10:53:59 standrew dovecot: child 44134 (pop3) returned error 89 Any suggestion? Thanks in advance. Thomas -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. Postmaster http://www.stthomasanglican.org

1 0

[Dovecot] SSL Ciphers
by John Wentworth 23 Apr '04

23 Apr '04

I have dovecot running as a pop3s server on port 995 it works great with sendmail and I run nessus to check security issues nessus reports this The SSLv2 server offers 3 strong ciphers, but also 0 medium strength and 2 weak "export class" ciphers. The weak/medium ciphers may be chosen by an export-grade or badly configured client software. They only offer a limited protection against a brute force attack Solution: disable those ciphers and upgrade your client software if necessary I have previously disabled weak ciphers in apache but cannot figure out how to disable the weak ciphers in dovecot Any help would be appreciated john

1 0

[Dovecot] SSL Ciphers
by John Wentworth 23 Apr '04

23 Apr '04

I have dovecot running as a pop3s server on port 995 it works great with sendmail and I run nessus to check security issues nessus reports this The SSLv2 server offers 3 strong ciphers, but also 0 medium strength and 2 weak "export class" ciphers. The weak/medium ciphers may be chosen by an export-grade or badly configured client software. They only offer a limited protection against a brute force attack Solution: disable those ciphers and upgrade your client software if necessary I have previously disabled weak ciphers in apache but cannot figure out how to disable the weak ciphers in dovecot Any help would be appreciated john

1 0

[Dovecot] Is dovecot distributed with RHEL 3.0
by Avery 20 Apr '04

20 Apr '04

I can't seem to find out if dovecot is packaged with RHEL 3.0. It seems redhat makes it hard to find what packages you get when you purchase their RHEL. Does anyone know if dovecot is disributed with Red Hat Enterprise Linux ES 3.0? I know dovecot is distribured with redhat 9.0 and fedora. Thanks, -- Avery

4 3

[Dovecot] configuring dovecot for NIS (w/ pam)
by Yedidia Klein 20 Apr '04

20 Apr '04

Hi, I am trying to start using dovecot on a linux machine. I config it to auth w/ my passwd/shadow and it worked perefectly. I'm not getting to config it to work with my SUN NIS (not +) As I understood I must use PAM for this, I tried to config it w/o any success... do someone has a config file/ pam config for this ? thanks --Yedidia

1 0

[Dovecot] RE: dovecot Digest, Vol 12, Issue 21
by Alban Dani 20 Apr '04

20 Apr '04

Hi Adrian, You are right. I had a space after the .1. Now dovecot is listening fine on 127.0.0.1. Thanks a lot. I would have never thought of it. Alban Date: Tue, 20 Apr 2004 08:37:21 +0200 From: Adrian Ulrich <dovecot(a)blinkenlights.ch> Subject: Re: [Dovecot] Can't resolve address 127.0.0.1 To: dovecot(a)dovecot.org Message-ID: <20040420083721.1d1a4323.dovecot(a)blinkenlights.ch> Content-Type: text/plain; charset=US-ASCII Hello, > imap_listen = 127.0.0.1 Check if you have a space after .1: 'imap_listen = 127.0.0.1' maybe not the same as 'imap_listen = 127.0.0.1 ' bye

1 0

Re: [Dovecot] Can't resolve address 127.0.0.1
by Alban Dani 20 Apr '04

20 Apr '04

Rick thanks for the message, -I have not done any changes to the default nsswitch.conf. I checked and the entry hosts: files dns is there -127.0.0.1 localhost entry is in the /etc/hosts file. -ifconfig shows that the interface is up and I can successfully ping it by name ( ping localhost ). What else can be wrong. I am totally lost here. Alban Rick Johnson wrote: >Alban Dani wrote: >> Hi , >> >> I recently installed Fedora Core 1. >> >> Installed postfix on it and that is running fine. >> >> I am trying to get dovecot to run and I have changed only the following >> line from the default dovecot.conf : >> >> imap_listen = 127.0.0.1 since I'd like to install squirrelmail later on. >> >> Now when I try to start dovecot I get "Starting Dovecot Imap: Fatal: >> Can't resolve address 127.0.0.1 : Name or service not known" > >Does /etc/hosts still contain an entry for localhost? > >Does /etc/nsswitch.conf still reference files for name resolution? > >Is the interface lo active? (run ifconfig to find out) > >-Rick > >-- >Rick Johnson, RHCE #807302311706007 - rjohnson(a)medata.com >Linux/Network Administrator - Medata, Inc. >PGP Public Key: https://mail.medata.com/pgp/rjohnson.asc >

2 1