- dovecot - dovecot.org

v2.2.30 released
by Timo Sirainen 13 Jun '17

13 Jun '17

https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.30.tar.gz.sig * auth: Use timing safe comparisons for everything related to passwords. It's unlikely that these could have been used for practical attacks, especially because Dovecot delays and flushes all failed authentications in 2 second intervals. Also it could have worked only when passwords were stored in plaintext in the passdb. * master process sends SIGQUIT to all running children at shutdown, which instructs them to close all the socket listeners immediately. This way restarting Dovecot should no longer fail due to some processes keeping the listeners open for a long time. + auth: Add passdb { mechanisms=none } to match separate passdb lookup + auth: Add passdb { username_filter } to use passdb only if user matches the filter. See https://wiki2.dovecot.org/PasswordDatabase + dsync: Add dsync_commit_msgs_interval setting. It attempts to commit the transaction after saving this many new messages. Because of the way dsync works, it may not always be possible if mails are copied or UIDs need to change. + imapc: Support imapc_features=search without ESEARCH extension. + imapc: Add imapc_features=fetch-bodystructure to pass through remote server's FETCH BODY and BODYSTRUCTURE. + imapc: Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the remote server. + passdb imap: Add allow_invalid_cert and ssl_ca_file parameters. + If dovecot.index.cache corruption is detected, reset only the one corrupted mail instead of the whole file. + doveadm mailbox status: Add "firstsaved" field. + director_flush_socket: Add old host's up/down and vhost count as parameters - More fixes to automatically fix corruption in dovecot.list.index - dsync-server: Fix support for dsync_features=empty-header-workaround - imapc: Various bugfixes, including infinite loops on some errors - IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't enabled modseq tracking via CONDSTORE/QRESYNC. - fts-lucene: Fix it to work again with mbox format - Some internal error messages may have contained garbage in v2.2.29 - mail-crypt: Re-encrypt when copying/moving mails and per-mailbox keys are used. Otherwise the copied mails can't be opened. - vpopmail: Fix compiling

7 12

rescann / reindex / rebuild a subfolder structure
by Götz Reinicke - IT Koordinator 13 Jun '17

13 Jun '17

Hi, an user is missing all mail from a folder and all subfolders which are still saved in the users maildir directory on the dovecot server. From an imap client she sees the main folder but empty. No subfolders. She told me with an other imap client and a new created account she has the same problem. Question: Can I resync / regenerate some folder... index.... something....-files from the dovecot side? Thanks for hints and regards . Götz

1 0

Re: Minor patches for builds against ancient platforms
by Joseph Tam 12 Jun '17

12 Jun '17

> On that note, has anyone written a tool that "harmonises" users mail > directories' permissions - ideally reading the dovecot configuration to assess > where *THE* mail directories are actually used by dovecot? doveadm user $user which will supply the second half: it will spit out the UID, GID, home and mail directories of a user as specified by dovecot's configuration. > I was surprised by the pickiness of the group ownership/permissions > issues, though reflecting on things, I can see why you'd at least want > some logging by default for those conditions. This is a consequence of writing secure software: it employs least privilege so that a fault will not result in someone being able to mess around with someone else's mail (or indices). GID can also govern access to shared mailboxes. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: namespace and folders
by Joseph Tam 12 Jun '17

12 Jun '17

Gregory Sloop <gregs(a)sloop.net> writes: > Using mbox format and this namespace > > namespace { > inbox = yes > hidden = yes > prefix = INBOX/ > } > ... > This is not a terrible problem, but it's cosmetically ugly and confusing for users. > I'd prefer to only see these folders as subscribed as sub-folders [or sub-items] under inbox. Pardon my naievty, but couldn't you just remove this namespace altogether and get rid of at least one set of duplicates (although it probably keep the non-preferred one). Joseph Tam <jtam.home(a)gmail.com>

1 0

service(auth): command startup failed?
by HL1234 12 Jun '17

12 Jun '17

Hello, I need help because since some days I can not figure out what error this is and where it come from. I have used dovecot since years. Know after an update it is broken. First I like to give you some data: It's a FreeBSD 11.0 Server with sendmail (SMTP) and dovecot for IMAP with SSL. #dovecot --build-options Build options: ioloop=kqueue notify=kqueue ipv6 openssl io_block_size=8192 Mail storages: shared mdbox sdbox maildir mbox cydir imapc pop3c raw fail SQL drivers: mysql Passdb: checkpassword ldap pam passwd passwd-file sql Userdb: checkpassword ldap nss passwd prefetch passwd-file sql #dovecot --version 2.2.30.2 (c0c463e) I install the update with the FreeBSD ports. Before the update all was running fine. The state know is: form my client Outlook I can send eMail above SMTP. When I try to get my eMails by the IMAP-Server it is blocked. I have look around in the config files but I see nothing what has could be changed. I have tried to make new *.pem files with using the script in /usr/local/share/examples/dovecot/ but this havn't bring a solution. I need help for this error i see in the logs: dovecot.log master: Error: service(auth): command startup failed, throttling for 2 secs auth: Error: auth: environment corrupt; missing value for DOVECOT_ auth: Fatal: unsetenv(RESTRICT_SETUID) failed: Bad address auth: Error: auth: environment corrupt; missing value for DOVECOT_ auth: Fatal: unsetenv(RESTRICT_SETUID) failed: Bad address ..... dovecot-info.log imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 1 secs): user=<>, rip=77.178.105.78, lip=88.74.25.120, TLS Jun 12 23:01:15 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=58.218.194.81, lip=88.74.25.120, TLS handshaking .... dovecot-debug.log imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [77.178.105.78] imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [77.178.105.78] imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [77.178.105.78] imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [77.178.105.78] auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth auth: Debug: Module loaded: /usr/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat Have anyone an idea what is going wrong and how to fix it? Harald -- View this message in context: http://dovecot.2317879.n4.nabble.com/service-auth-command-startup-failed-tp… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

Redis auth?
by Mark Moseley 12 Jun '17

12 Jun '17

I was curious what the status of this redis auth patch is: https://dovecot.org/list/dovecot/2016-June/104763.html

1 0

Re: Log authentication attempts
by j.emerlik 12 Jun '17

12 Jun '17

We alse have same problem, now we are running Dovecot 2.2.30.2 and also use Dovecot SASL for SMTP authentication (postfix 2.11). We need to save all failed login attempts to database as source IP address, username and date and time but post-login script can do this but only after successful login. Failed login attempts information may be useful in the fight with bruteforce attacks. It's possible to execude some script after failed login ("Password mismatch") ? Regards, Jacek

4 5

pigeonhole: imapsieve: AntiSpam example
by Larry Rosenman 12 Jun '17

12 Jun '17

Is there a reason why vnd.dovecot.execute is called out for sieve_global_extensions but no configuration or require is there for it on: https://wiki.dovecot.org/HowTo/AntispamWithSieve thanks! -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 3

namespace and folders
by Gregory Sloop 12 Jun '17

12 Jun '17

Using mbox format and this namespace namespace { inbox = yes hidden = yes prefix = INBOX/ } [Though I've also tried, seemingly, a million different namespace options to "fix" my problem.] It's a migrated setup from a 1.x dovecot install from Ubuntu 12.04, now on 16.04 The problem is in TBird [I haven't tested with any other mail clients] and IMAP; with that name-space I get all the folders both at the root level [same as inbox], as well as below inbox. [The same folders, pointing at the same underlying messages.] For example, if there's a folder "blah" and I subscribe to it, "blah" shows both at the same level as inbox, as well as a sub-item of inbox. If I unsubscribe from folder "blah" it also unsubscribes from the subfolder "blah" under inbox, and at the root level. [I hope that's clear enough...] This is not a terrible problem, but it's cosmetically ugly and confusing for users. I'd prefer to only see these folders as subscribed as sub-folders [or sub-items] under inbox. I'd guess I'm making some stupid beginner error, but I've not been able to figure it out, as of yet. Any help would be greatly appreciated. -Greg

1 1

AIX packaging: src/plugin/quota does not build
by Michael Felt 12 Jun '17

12 Jun '17

#stdout to /dev/null to see only the error messages It comes down to more issues with how IBM xlc handles (less elegantly) Compound Literals compared to GCC. michael@x071:[/data/prj/aixtools/github/dovecot/x071-test]make -i >/dev/null "../../../../src/x071-test/src/plugins/quota/quota.c", line 382.17: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota.c", line 383.17: 1506-196 (S) Initialization between types "void(* const)(struct quota_root*,const char*)" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota.c", line 384.17: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota.c", line 385.17: 1506-196 (S) Initialization between types "void(* const)(struct quota_root*,const char*)" and "struct quota_param_parser" is not allowed. make[4]: [quota.lo] Error 1 (ignored) The above issues I resolved by changing /* * Sigh, xlc and Compound Literals * struct quota_param_parser quota_param_hidden = {.param_name = "hidden", .param_handler = hidden_param_handler}; struct quota_param_parser quota_param_ignoreunlimited = {.param_name = "ignoreunlimited", .param_handler = ignoreunlim_param_handler}; struct quota_param_parser quota_param_noenforcing = {.param_name = "noenforcing", .param_handler = noenforcing_param_handler}; struct quota_param_parser quota_param_ns = {.param_name = "ns=", .param_handler = ns_param_handler}; */ to #define quota_param_hidden {.param_name = "hidden", .param_handler = hidden_param_handler} #define quota_param_ignoreunlimited {.param_name = "ignoreunlimited", .param_handler = ignoreunlim_param_handler} #define quota_param_noenforcing {.param_name = "noenforcing", .param_handler = noenforcing_param_handler} #define quota_param_ns {.param_name = "ns=", .param_handler = ns_param_handler} Unfortunately, this did not help quota-fs.c, so I move the defines to quota.h. However, since hidden_param_handler() is defined as a static routine, it is not visible outside of quota.c. As such the error messages change from: "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 125.17: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 125.37: 1506-196 (S) Initialization between types "void(* const)(struct quota_root*,const char*)" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 125.62: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 126.18: 1506-515 (S) Member designator cannot be applied to an object of type "const struct quota_param_parser[]". make[4]: [quota-fs.lo] Error 1 (ignored) "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.17: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.37: 1506-196 (S) Initialization between types "void(* const)(struct quota_root*,const char*)" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.66: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.91: 1506-196 (S) Initialization between types "void(* const)(struct quota_root*,const char*)" and "struct quota_param_parser" is not allowed. make[4]: [quota-dict.lo] Error 1 (ignored) "../../../../src/x071-test/src/plugins/quota/quota-imapc.c", line 66.17: 1506-196 (S) Initialization between types "char* const" and "struct quota_param_parser" is not allowed. "../../../../src/x071-test/src/plugins/quota/quota-imapc.c", line 67.18: 1506-515 (S) Member designator cannot be applied to an object of type "const struct quota_param_parser[]". make[4]: [quota-imapc.lo] Error 1 (ignored) libtool: error: 'quota.lo' is not a valid libtool object make[4]: [lib10_quota_plugin.la] Error 1 (ignored) libtool: error: 'quota.lo' is not a valid libtool object make[4]: [quota-status] Error 1 (ignored) make[4]: *** No rule to make target `../quota/lib10_quota_plugin.la', needed by `lib11_imap_quota_plugin.la'. Stop. make[3]: [all-recursive] Error 1 (ignored) to: michael@x071:[/data/prj/aixtools/github/dovecot/x071-test/src/plugins/quota]make -i >/dev/null "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 125.17: 1506-045 (S) Undeclared identifier hidden_param_handler. "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 126.17: 1506-045 (S) Undeclared identifier noenforcing_param_handler. "../../../../src/x071-test/src/plugins/quota/quota-fs.c", line 127.17: 1506-045 (S) Undeclared identifier ns_param_handler. make: [quota-fs.lo] Error 1 (ignored) "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.17: 1506-045 (S) Undeclared identifier hidden_param_handler. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.37: 1506-045 (S) Undeclared identifier ignoreunlim_param_handler. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.66: 1506-045 (S) Undeclared identifier noenforcing_param_handler. "../../../../src/x071-test/src/plugins/quota/quota-dict.c", line 47.91: 1506-045 (S) Undeclared identifier ns_param_handler. make: [quota-dict.lo] Error 1 (ignored) "../../../../src/x071-test/src/plugins/quota/quota-imapc.c", line 66.17: 1506-045 (S) Undeclared identifier ns_param_handler. make: [quota-imapc.lo] Error 1 (ignored) libtool: error: 'quota-fs.lo' is not a valid libtool object make: [lib10_quota_plugin.la] Error 1 (ignored) libtool: error: 'quota-fs.lo' is not a valid libtool object make: [quota-status] Error 1 (ignored) For me, this is a procedure declaration issue I may not resolve on my own - I must assume there is a reason that these routines are "static". Michael p.s. Once this is resolved I hope to be able to use "make check". I had to massage the Makefiles to get gnulib/getopt to link into dovecot. Once I can run "make check" I'll request help on how to get a new directory included in the Makefile list, and also assistance with making sure it can also work with out-of-tree builds.

1 0