- dovecot - dovecot.org

Re: Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Joseph Tam 16 Nov '23

16 Nov '23

On Wed, 15 Nov 2023, 23:25 Michael Peddemors, <michael(a)linuxmagic.com> wrote: > Not sure yet if it is Dovecot, or the SSL libraries they are > attempting > to break, but using a variety of SSL/TLS methods and connections... > > They are not interested in dovecot per se. They scan for TLS vulnerabilities, > mostly. They're running comprehensive port scans, so they're targeting more than just SSL services. > OrgName: Academy of Internet Research Limited Liability > Company > OrgId: AIRLL > Address: #A1- 5436 > Address: 1110 Nuuanu Ave > City: Honolulu > StateProv: HI > PostalCode: 96817 > Country: US Out of business virtual offices, naturally. AIRLL also operating out of 195.96.137.0/24. Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: auth service over tls
by ibra 16 Nov '23

16 Nov '23

I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: > > Are Postfix and Dovecot running on the same server? If so, you might be > better served by connecting with a UNIX socket rather than TCP. > > I'm not sure there is much security benefit to using TLS on the loopback > interface which is what was in your example from the previous email. > > And to clarify, Postfix supports TLS for authentication between an email > program like Thunderbird and the Postfix server, but does not support TLS > for the SASL AUTH *service* connection from Postfix to the AUTH provider > (Dovecot or Cyrus-SASL). > > Also, please use the group reply function so your email goes to the list, > this email only went to me. > > > On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: > > Good Morning, > thank you for your fast response, and sorry to not answer before, I forgot > to check spam folder. Good to know that postfix does not support SASL AUTH > over TLS, because actually I was planning to use it. > I started with Dovecot to check if auth port support tls. For that I > launched tls handshake using openssl, like this command: > $ openssl s_client -servername mail.sample.com -connect localhost:12345 > > But I got an error. (In summary Dovecot ends the connection). > Anyway, it would be awesome that in the future both Postfix and Dovecot > could support it. > > > On LMTP port, tls handshake worked in Dovecot side, now I have to > configure Postfix to make the request to dovecot LMTP over tls. > > With Postfix I was able to send data to Dovecot LMTP port, but was not > over TLS. Do you know what settings should I enable in Postfix side? > > Regards > Ibra. > > > On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> > wrote: > > On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: > > Hi, > I'm trying running tls connections for both auth and lmtp services. For > lmtp it is ok, for auth service I couldnt make it. I configure dovecot with > the next configuration in file "conf.d/10-myconfig.conf": > > > Which MTA are you trying to connect from? Postfix does not support SASL > AUTH over TLS, for example. > > > I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: Are Postfix and Dovecot running on the same server? If so, you might be better served by connecting with a UNIX socket rather than TCP. I'm not sure there is much security benefit to using TLS on the loopback interface which is what was in your example from the previous email. And to clarify, Postfix supports TLS for authentication between an email program like Thunderbird and the Postfix server, but does not support TLS for the SASL AUTH *service* connection from Postfix to the AUTH provider (Dovecot or Cyrus-SASL). Also, please use the group reply function so your email goes to the list, this email only went to me. On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: Good Morning, thank you for your fast response, and sorry to not answer before, I forgot to check spam folder. Good to know that postfix does not support SASL AUTH over TLS, because actually I was planning to use it. I started with Dovecot to check if auth port support tls. For that I launched tls handshake using openssl, like this command: $ openssl s_client -servername mail.sample.com -connect localhost:12345 But I got an error. (In summary Dovecot ends the connection). Anyway, it would be awesome that in the future both Postfix and Dovecot could support it. On LMTP port, tls handshake worked in Dovecot side, now I have to configure Postfix to make the request to dovecot LMTP over tls. With Postfix I was able to send data to Dovecot LMTP port, but was not over TLS. Do you know what settings should I enable in Postfix side? Regards Ibra. On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> wrote: On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/ 10-myconfig.conf": Which MTA are you trying to connect from? Postfix does not support SASL AUTH over TLS, for example.

1 0

Fwd: dovecot submission max line length
by Kees van Vloten 14 Nov '23

14 Nov '23

Op 14-11-2023 om 14:35 schreef Aki Tuomi: >> On 14/11/2023 14:59 EET Kees van Vloten <keesvanvloten(a)gmail.com> wrote: >> >> Hi all, >> >> >> After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot >> 2.3.19), submission-login returns an error on Kerberos authentication: >> "Client sent invalid command: Command line is too long". >> >> When I initially set this up on Bullseye I have seen the same issue, but >> adding "imap_max_line_length = 2M" solved it. >> >> Now with 2.3.19 kerberos authentication still works (with this setting) >> for imap connections but it stopped working for submission. >> >> Is there a new config setting for submission-login that I missed? Or is >> this a bug in 2.3.19? >> >> >> - Kees. >> >> > You are probably running into a client-side issue. SMTP RFC says that > all commands, including sasl ir, must be at most 998 bytes. Can you > check if the client is sending AUTH KERBEROS which is longer than 998 > lines? > > After AUTH KERBEROS you can send longer lines. The client has not changed. I have just upgraded the server from Bullseye to Bookworm, without configuration changes to Dovecot. The only change is version 2.3.13 to 2.3.19, that is why my first suspicion is that something changed in dovecot submission-login. The client is Thunderbird 102 and that has not changed for a long time (a year or so). Is there a way to create debug logs that show the client communication to submission-login? I had enabled "auth_debug" and "auth_verbose" in Dovecot but that seems to log the server side communication only (see below). And even with that information, would it be possible to convince Thunderbird to send 'AUTH KERBEROS' if it does not do that already? I logging I have is this: Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sent: 220 mailserver.example.com Dovecot ready. Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Received new command: EHLO [192.168.1.106] Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: New command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Execute command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline blocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline unblocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Connection state reset Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Sent: 250-mailserver.example.com 8BITMIME AUTH GSSAPI GSS-SPNEGO PLAIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE PIPELINING Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Client sent invalid command: Command line is too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Invalid command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Remote closed connection: Connection closed Do note that I redacted a column with the server ipaddress to make the lines a bit shorter and more readable. - Kees > > Aki

1 0

MySQL connection keepalive for pass/auth db
by dvuoud＠at.encryp.ch 14 Nov '23

14 Nov '23

Hello, Is it possible to configure SQL connection keepalive for Dovecot? Probably what I have to do is "Note that the SQL backend must be used via Proxy", however I was unsucsessful in figuring out how can I setup this to get use of connection pool at Dovecot. Thanks. > $ dovecot --version > 2.3.20 (80a5ac675d) > $ dovecot -n > # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.20 (149edcf2) > # OS: Linux 6.1.57 x86_64 Gentoo Base System release 2.14 > # Hostname: flopster > import_environment = TZ CORE_OUTOFMEM CORE_ERROR TZ=:/etc/localtime > lmtp_add_received_header = no > mail_gid = vmail > mail_location = maildir:~/.maildir > mail_server_admin = mailto:me@at.encryp.ch > mail_uid = vmail > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader > metric auth_failures { > filter = event=auth_request_finished AND NOT success=yes > } > metric auth_success { > filter = event=auth_request_finished AND success=yes > } > metric imap_command { > filter = event=imap_command_finished > group_by = cmd_name tagged_reply_state > } > metric mail_delivery { > filter = event=mail_delivery_finished > group_by = duration:exponential:1:5:10 > } > metric smtp_command { > filter = event=smtp_server_command_finished > group_by = cmd_name status_code duration:exponential:1:5:10 > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = * > driver = pam > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > sieve_extensions = +editheader > } > protocols = imap lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > vsz_limit = 2 G > } > service dict { > unix_listener dict-passdb { > mode = 0600 > user = vmail > } > unix_listener dict-userdb { > mode = 0600 > user = vmail > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0600 > user = postfix > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service stats { > inet_listener http { > address = [::] > port = 9900 > } > } > ssl = required > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > userdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > protocol lmtp { > mail_plugins = " sieve" > postmaster_address = postmaster(a)at.encryp.ch > } > protocol lda { > mail_plugins = sieve > } > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = # hidden, use -P to show it > }

1 0

ldap passdb, userdb imap auth sasl and lmtp
by bd730c5053df9efb 14 Nov '23

14 Nov '23

Hi! I'm trying to setup dovecot 2.3.17 such that it authenticates users against a samba4 ad dc when they connect through imap. I would also need dovecot to authenticate the same users through sasl so that postfix can relay mails based on the user's auth and finally I would also need for an lmtp service that maps email addresses into AD users. I've been tinkering with dovecot-ldap.conf.ext using auth_bind = yes and no, with all sorts of pass_filters, user_filter, pass_attr and user_attr and I just can't figure out how it works. I assume that for the auth part (both imap and sasl) I would rather benefit with using auth_bind = yes and auth_bind_userdn = %u and I seem to be able to authenticate the user but I can't get the passdb to prefetch the userdb attributes. I also assume that for lmtp to be able to fetch the ad information it would be necessary for dovecot to be able to bind to the ad ldap server with a "service account" to be able to query the ldap server and I haven't been able to figure out how to have both kinds of auth schemas. Does anyone know of some documentation that could clarify some of this issues, I have been searching the web for days to no avail. I'm sorry I can't show what I have tried for I have tried so many things with more or less the same lack of success that I wouldn't know where to start. Thanks in advance. Best regards, Dave.

2 1

More information on dict proxy
by Steve 09 Nov '23

09 Nov '23

Hello, I'm working on an implementation of a dict server. I've looked through all your documentation but can't seem to find how I can create the proper URI to direct the quota plugin to use a TCP socket instead of a UNIX socket. I'd appreciate any insight you can provide. Steve

2 1

file dotlock create
by The Doctor 07 Nov '23

07 Nov '23

I am seeing errors in our log as follows Nov 07 14:20:06 POP3(user937):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user937) failed: Permission denied (euid=937(user937) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) /var/mail is set to 1775 Running FreeBSD 14.0-RC4 -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Suffering will continue until we stop believing lies. -unknown Beware https://mindspring.com

1 0

mail boxes on net mounted filesystem with multiple Dovecots
by lejeczek 07 Nov '23

07 Nov '23

Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount-point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L. Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount- point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L.

4 3

Can Dovecot Use Wildcard TLS Certificates?
by duluxoz 07 Nov '23

07 Nov '23

Hi All, Quick Q: Can dovecot use wildcard TLS Certificates? I'm having issues with a new dovecot/postfix stack set-up and I can't get mutt on the local box to connect via imap - its coming back with an SSL error, and as I'm using a wildcard cert for the domain I was wondering if that was my issue. If dovecot can use wildcard certs then I'll look elsewhere in my troubleshooting. Thanks in advance Cheers Dulux-Oz

8 7

Minimum configuration for Dovecot SASL only?
by Nick Lockheart 06 Nov '23

06 Nov '23

I have a Dovecot IMAP server and a Postfix server on separate machines. The user information is stored in a MariaDB database that is replicated on both servers. Postfix needs to authenticate outgoing mail against our valid user database. I believe this requires us to install a "dummy" Dovecot on the Postfix server so that Dovecot SASL can provide authentication to Postfix from the database. I think Cyrus had a standalone Cyrus-SASL package, but Dovecot doesn't? If I wanted to setup a Dovecot instance on the Postfix server just for the purposes of SMTP authentication, and not use it to handle any mail, what is the minimum configuration required to make that work? Is the dovecot-common package (Debian) enough? Or do I need the full dovecot-imap package? What protocols go in the protocols directive? Can you just make it "protocols = auth" to disable IMAP connections?

5 9