- dovecot - dovecot.org

Re: under another kind of attack
by Davide Marchi 30 Jul '17

30 Jul '17

Hi to all, @Olaf Hopp I've this filter enabled for fail2ban, my question is: could my filters overlap or interfere with those suggested by you? this is my filter: Contents of /etc/fail2ban/jail.conf: [postfix] # Ban for 10 minutes if it fails 6 times within 10 minutes enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log maxretry = 6 bantime = 600 findtime = 600 Contents of /etc/fail2ban/filter.d/postfix.conf: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision$ [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # # Jul 11 02:35:08 mail postfix/smtpd[16299]: lost connection after AUTH from unknown[196.12.178.73] failregex = lost connection after AUTH from unknown\[<HOST>\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = Many thanks!

2 1

Re: under another kind of attack
by Joseph Tam 28 Jul '17

28 Jul '17

(I think I am testing other readers' patience, so if you want to follow-up, you can Email me directly.) > but how often do you have to type your username ? Not often, but I'm not talking the typical case. The larger the population you serve, the more circumstances you'll have to cover. > Only on the initial config of your mailer. After that you are done. Mail reader setups by users is often an error prone process, judging from the number of times I have to correct a setup. This is especially true for an educational institution that typically has a large turnover of accounts. If a user gets it initially wrong, then fixes their mistake, they can't get it to work despite trying all sorts of config variations, not realizing it can't be resolved anymore. Result: trouble call. If someone blows it setting on a multi-user workstation, other users with a working setups can't log in. Result: trouble call. If a student flubs their credentials, all the roommates behind their residential NAT gateway suffer. Result: trouble call. If a user screws up using an external service that slurps their mail (e.g. Gmail, Yahoo, uniboxapp, etc.), or worse, someone malicious does it on puropse, all other users of this service will be DoS'd. Result: trouble call(s). If a user acquires a DHCP address in a polluted network ..., well you get the idea. Not to mention ex-users who forget to remove their mail accounts from their smartphones, leaving a trail of blacklist entries in their wake as they travel from coffee shops to other public WiFi hotspots. > So this is why I decided to use two distinct jails with > different policies. It seems to work reasonable well. Until it doesn't. If it works for you, more power to you. The cost/benefit of a hair-trigger blacklist policy is that it saves you a few log entries showing futile attempts at finding weak passwords (because you have strong passwords, don't you?) at the risk of dealing with any of the above situations. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 27 Jul '17

27 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> wrote: > And I have a new one just for "unknown user" and here my bantime and findtime > are much bigger and the retries are just '2'. So here I'm much harsher. > I'll keep an eye on my logs and maybe some more twaeking is necessary. Just be careful about typos (like twaeking!): users could simply misspell their username, or get mixed up with some another account or alias. This is why I favour targetting known bad accounts, not merely accounts that don't exist. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission
by Davide Marchi 26 Jul '17

26 Jul '17

> From: Thomas Leuxner <tlx(a)leuxner.net> >> cat /etc/dovecot/dovecot-acl >> * user=booking(a)hotelsangiorgioriccione.com lrwsi >> * user=info(a)hotelsangiorgioriccione.com lrwsi > Hi Davide, > > For LMTP to file the mails you need to add the p flag (POST). Well, I've added the "p" flag and now I will monitor the situation ;-) PS Just as an additional note, just after making this change and reload Dovecot I have detected (oneshot) this error message: Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF But now everything seems to work well (let's hope) ;-) Many thanks Thomas!

1 0

Return extra fields from passwd userdb
by Michele Petrella 26 Jul '17

26 Jul '17

Hi all. I use dovecot 2.2.29.1. Output of dovecot -n: # 2.2.29.1 (e0b76e3): /var/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) # OS: Linux 3.10.55-gentoo i686 SuSE Linux 7.1 (i386) debug_log_path = /var/log/dovecot/dovecot_debug.log disable_plaintext_auth = no info_log_path = /var/log/state.mail/dovecot.pipe log_path = /var/log/dovecot/dovecot.log mail_debug = yes mail_gid = users mail_location = maildir:~/.maildir mail_plugins = acl quota mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/data/home/vmail/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:/data/home/%%n/.maildir:INDEX=~/.maildir/shared/%%u prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Cestino { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox "Posta inviata" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot-dict/shared-mailboxes quota = maildir:User quota quota_rule = *:storage=5M quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore sieve = ~/.dovecot.sieve sieve_before = /var/etc/dovecot/sieve/general/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/dovecot/sieve-execute sieve_filter_bin_dir = /usr/local/bin/dovecot/sieve-filter sieve_global_dir = /var/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.filter +vnd.dovecot.pipe +editheader sieve_pipe_bin_dir = /usr/local/bin/dovecot/sieve-pipe sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = users } } service imap-postlogin { executable = script-login /usr/local/bin/imap-postlogin.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } ssl = no ssl_cert = </conf/etc/cert/certs/services/imap_pop/majornet.crt ssl_key = # hidden, use -P to show it userdb { default_fields = quota_rule=*:bytes=%$ driver = passwd } protocol lda { info_log_path = /var/log/dovecot/dovecot-lda.log log_path = /var/log/dovecot/dovecot-lda.log mail_plugins = acl quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl quota imap_acl imap_quota } I have problems in return extra fields from passwd userdb. My users are partially in passwd files and partially in LDAP. Users who use mail are in LDAP db. If I use "default_fields = quota_rule=*:bytes=100M" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=100M system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=100M doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(afasystems): Debug: Quota grace: root=User quota bytes=10485760 (10%) doveadm(afasystems): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/.maildir doveadm(afasystems): Debug: maildir++: root=/data/home/afasystems/.maildir, index=, indexpvt=, control=, inbox=/data/home/afasystems/.maildir, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 1 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/data/home/vmail/public doveadm(afasystems): Debug: maildir++: root=/data/home/vmail/public, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/data/home/%n/.maildir:INDEX=~/.maildir/shared/%u doveadm(afasystems): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(afasystems): Debug: Namespace : Using permissions from /data/home/afasystems/.maildir: mode=0700 gid=default Quota name Type Value Limit % User quota STORAGE 469 102400 0 User quota MESSAGE 6 - 0 That's ok, but i want to return quota from quotaBytes userdb parameter But if I use "default_fields = quota_rule=*:bytes=%$" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{userdb:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{ldap:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=UNSUPPORTED_VARIABLE_ldap: Invalid bytes limit: UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Error: User init failed Quota name Type Value Limit Where I am wrong? What is the correct configuration? Thanks in advance -- AFA Systems Srl Via G.Pastore Zona Industriale B 86039 Termoli (CB) - Italia tel.: +39 0875 724104 fax.: +39 0875 726084 www.afasystems.it

5 7

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

Steffen Kaiser ha scritto: > Does INBOX/Junk already exists? Yes, (but empty): find /var/vmail/hotelsangiorgioriccione.com/info/ |grep INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/dovecot.index.log /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/dovecot.index.log and same for other v-user "booking" > What's in your ACL file? cat /etc/dovecot/dovecot-acl * user=booking(a)hotelsangiorgioriccione.com lrwsi * user=info(a)hotelsangiorgioriccione.com lrwsi > What does these commands return? > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX is visible in LIST doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX/Junk' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX/Junk is visible in LIST Many thanks Steffen!

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

I add a clarification: Now that I've commented out sieve Junk/Trash on "/etc/dovecot/conf.d/15-mailboxes.conf" > mailbox Junk > { special_use = \Junk > } > mailbox Trash > { special_use = \Trash > } remains a single account with permission issues, only one with write permissions controlled by the ACL plugin: > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > sieve = ~/.dovecot.sieve > sieve_after = /etc/dovecot/sieve-after > sieve_dir = ~/sieve > } Many thanks again!

2 1

Issue on install - file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2)
by Ian Turley 26 Jul '17

26 Jul '17

First of all apologies for using such an old version - I am trying to upgrade slowly and have had to go through this version first. As you can see I am getting an error in the log file as : file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2) Raw backtrace: imap [0x80acdc1] -> imap [0x80accdc] -> imap(mbox_sync+0x14e9) [0x8079a29] -> imap(mbox_storage_sync_init+0x3e) [0x8079d8e] -> imap(imap_sync_nonselected+0x1c) [0x806183c] -> imap(_cmd_select_full+0xc3) [0x8059983] -> imap(cmd_select+0x19) [0x8059b49] -> imap [0x805afb8] -> imap [0x805b03c] -> imap(_client_input+0x6c) [0x805b71c] -> imap(io_loop_handler_run+0x110) [0x80b2a50] -> imap(io_loop_run+0x1c) [0x80b1f8c] -> imap(main+0x4c0) [0x8063640] -> /lib/libc.so.6(__libc_start_main+0xdc) [0xdd4edc] -> imap [0x80561a1] Is this some setting missing or corrupt mailbox? I only have very basic set up at this time to test. Version 1.0.7 # 1.0.7: /etc/dovecot.conf ssl_cert_file: /etc/postfix/certs/emma.turls.co.uk.crt ssl_key_file: /etc/postfix/certs/turls_csr.key login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail/:INBOX=/var/spool/mail mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Regards Ian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> writes: > I have dovecot shielded by fail2ban which works fine. But since a few > days I see many many IPs per day knocking on my doors with wron > password and/or users. But the rate at which they are knocking is very > very low. So fail2ban will never catch them. Slow roll distributed attacks. Really hard to stop. > And I see many many distinct IPs per day (a few hundred) trying many > many existing and non-existings accounts. As you see in the timestamps > in my examples, this can not be handled by fail2ban without affecting > regular users with typos. Is anybody observing something similar ? All the time, and to many services. If you need to be fault tolerant, you'll either have to set tolerant limits (allow reasonable number of failures), or timeout features. You could also track successful logins as whitelisting entries for future logins. > Anybody an idea against this ? Many of these observed IPs are chinese > mobile IPs, if this matters. But we have also chinese students and > researchers all abroad. Nearly an intractable problem, especially since your users are embedded in a notoriously infested network (as someone quipped, "like picking marshmallows out from a pile of sh*t"). Some ideas: - pre-emption (using third party RBLs that targets BFD) - immediate blacklisting of known bad users/passwords (e.g. "admin", "support", extinct users, etc.) - persistent tracking storage: tracking in SQL, or or large LRU list that can reach far enough back in time. (I think Aki mentioned weakforced which you can use instead if fail2ban to implement some of these things.) There are other solutions like alternate ports, port knocking, certificate authentication, or VPN, but they are hard/impossible to do with a large userbase, or have high setup/amortization costs. If you have a enforced strong password policy, these brute forcers have little chance of succeeding, so maybe the easiest cheapest policy is to ignore it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

"mourik jan c heupink" <lists(a)merit.unu.edu> writes: > On 07/24/2017 04:51 AM, Joseph Tam wrote:> You are essentially writing your own backend by taking over >> authentication. You'll be accepting user/password inputs into your >> checkpassword executable, then use the LDAP API (or some other system...snip >> and source address, which will be adversely affect performance on a >> busy server as authentication data cannot be cached. > > While this sounds awesome, it can do much more than what I was/am after, and appears lot more complicated to setup than what I had figured myself. > > Shouldn't I be able to do something like this: > > passdb { > driver = passwd-file > # application specific passwd-file should work from anywhere > # (so: no allow_nets) > args = /etc/dovecot/dovecot-application-specific > } > passdb { > # only allowed to use this from within local 192.168.1.0/24 > args = /etc/dovecot/dovecot-ldap.conf.ext allow_nets=192.168.1.0/24 > driver = ldap > } Yes, that would take care of *one* of the items on your wishlist (network specific passwords). You also wanted time specific passwords. And intelligent brute force detection. And blacklist lookups. Rather than cobbling together fail2ban, utility scripts, multiple passdbs, firewall rules and whatever other system you'll need to recruit, I'm suggesting you amortize the effort and pack it into one place, then you can extend this to incorporate whatever your heart desires. The complexity of implementing this reflects the complexity of your requirements. If you only had generic authentication needs, then the dovecot supplied facilities would be perfect. But you don't. > Where I would generate lines in dovecot-application-specific using a > script or some webpage, and generate lines like: > > username1:randomONE:vmail:vmail::/var/vmail/username1: > username1:randomTWO:vmail:vmail::/var/vmail/username1: > username2:randomTHREE:vmail:vmail::/var/vmail/username2: > username2:randomFOUR:vmail:vmail::/var/vmail/username2: > > And the result would be: username1 can login from anywhere, using > passwords "randomONE" & "randomTWO", plus the password in ldap when > coming from the internal network. You'll probably need 3 passdb, LDAP and 2 fallback passwd-file dbs. Joseph Tam <jtam.home(a)gmail.com>

1 0

SIEVE: handling of lineending in fields
by Ingo Thierack 25 Jul '17

25 Jul '17

Hello, migrated von the mailserver from centos to alpine linux. Most parts are run well. dovecot 2.2.31 sieve: 0.4.19 But i fight with on behavior. I have an sieve script which pipes a few fields to an external script which send this data to an telegram-bot. the part of the sieve-script. if header :matches "Subject" "*" { set "subject" "${1}"; } if header :matches "from" "*" { set "from" "${1}"; } if header :matches "to" "*" { set "to" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 30 "msgcontent"; break; } } pipe :copy :try "notify.sh" [ "", "(${from})#${to}#${subject}", "\"${msgcontent}\"" ]; What i get now is an error about looks like encoding of the linefeeds. default: line 107: error: specified :args item `"test 4??"' is invalid. Here is sent a mail which contains in subject "test 4". or default: line 107: error: specified :args item `"?? ?? ??? ??? Oracle Magazine "' is invalid. Here is sent a mail which contains in subject "test 4". On centos this was never an problem. With alpine-linux this process is complete broken. Any hints, where to look and maybee fix thie behavior? Mybe its ab problem with the libmusl which used in alpine. Regards Ingo

2 2

last_logon SQL mapping
by viper 25 Jul '17

25 Jul '17

Hi I have been attempting to do a mapping on the last_logon plugin. I have been reading the documentation on mapping. is there any way to customise a little more and create a individual SQL query for each of the functions SELECT and UPDATE, my current SQL setup has the username and domain in separate tables and my user_query and password_query are concat which I do not believe can be defined in the dictionary map process, I was also wanting to use datatime as the saved field but it seems only the unix timestamp is used. If there is any way to create a fully custom query that can be executed I believe this would allow me to preform the action am looking for in the same manner as the user_query and password_query If anyone has any suggestions please let me know Regards Craig

2 1

Core dumped when authenticating to managesieve
by Kristjan Eentsalu 25 Jul '17

25 Jul '17

Hey, I'm getting "Error in MANAGESIEVE command received by server." and service(managesieve-login) killed with signal 11 (core dumped) when doing two line autenticate(sogo) to managesieve(). # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" {52+} XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== NO "Error in MANAGESIEVE command received by server." AUTHENTICATE "PLAIN" {52+} <---- trying again Connection closed by foreign host. and after that in logs there is "dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 38748 killed with signal 11 (core dumped)" One line autenticate works. # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==" OK "Logged in." OS: FreeBSD 11.1-RC3 Dovecot 2.2.31 , pigeonhole 0.4.19 Trace below GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)... warning: core file may not match specified executable file. Core was generated by `dovecot/managesieve-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/dovecot/libdovecot-login.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot-login.so.0 Reading symbols from /usr/lib/libssl.so.8...done. Loaded symbols for /usr/lib/libssl.so.8 Reading symbols from /lib/libcrypto.so.8...done. Loaded symbols for /lib/libcrypto.so.8 Reading symbols from /usr/local/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot.so.0 Reading symbols from /usr/lib/libkrb5.so.11...done. Loaded symbols for /usr/lib/libkrb5.so.11 Reading symbols from /usr/lib/libgssapi.so.10...done. Loaded symbols for /usr/lib/libgssapi.so.10 Reading symbols from /usr/lib/libgssapi_krb5.so.10...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.10 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/lib/libasn1.so.11...done. Loaded symbols for /usr/lib/libasn1.so.11 Reading symbols from /usr/lib/libcom_err.so.5...done. Loaded symbols for /usr/lib/libcom_err.so.5 Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/lib/libhx509.so.11...done. Loaded symbols for /usr/lib/libhx509.so.11 Reading symbols from /usr/lib/libroken.so.11...done. Loaded symbols for /usr/lib/libroken.so.11 Reading symbols from /usr/lib/libwind.so.11...done. Loaded symbols for /usr/lib/libwind.so.11 Reading symbols from /usr/lib/libheimbase.so.11...done. Loaded symbols for /usr/lib/libheimbase.so.11 Reading symbols from /usr/lib/libprivateheimipcc.so.11...done. Loaded symbols for /usr/lib/libprivateheimipcc.so.11 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 296 istream.c: No such file or directory. in istream.c (gdb) bt full #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 _stream = (struct istream_private *) 0x5385e16 #1 0x000000000536937a in i_stream_limit_read (stream=0x767d540) at istream-limit.c:34 lstream = (struct limit_istream *) 0x767d540 left = 123848760 ret = 1 pos = 119265200 #2 0x000000000535f340 in i_stream_read (stream=0x767d5b0) at istream.c:174 _stream = (struct istream_private *) 0x767d540 old_size = 0 ret = 124244864 #3 0x00000000053607ae in i_stream_read_data (stream=0x767d5b0, data_r=0x7fffffffe868, size_r=0x7fffffffe878, threshold=0) at istream.c:569 ret = 0 read_more = false #4 0x00000000004038d1 in ?? () No symbol table info available. #5 0x0000000000403c1a in ?? () No symbol table info available. #6 0x00000000004030ad in ?? () No symbol table info available. #7 0x0000000000402eaa in ?? () No symbol table info available. #8 0x0000000004838435 in client_input (client=0x76c0c10) at client-common.c:920 No locals. #9 0x000000000537028d in io_loop_call_io (io=0x76a4300) at ioloop.c:599 ioloop = (struct ioloop *) 0x763a000 t_id = 2 #10 0x0000000005372f74 in io_loop_handler_run_internal (ioloop=0x763a000) at ioloop-poll.c:209 ctx = (struct ioloop_handler_context *) 0x76340e0 pollfd = (struct pollfd *) 0x7673840 tv = {tv_sec = 0, tv_usec = 895835} io = (struct io_file *) 0x76a4300 msecs = 896 ret = 0 call = true #11 0x00000000053707f8 in io_loop_handler_run (ioloop=0x763a000) at ioloop.c:648 No locals. #12 0x0000000005370621 in io_loop_run (ioloop=0x763a000) at ioloop.c:623 No locals. #13 0x00000000052ad15b in master_service_run (service=0x7635000, callback=0x4840630 <client_connected>) at master-service.c:666 No locals. #14 0x00000000048402f7 in login_binary_run (binary=0x4061b8, argc=1, argv=0x7fffffffeb40) at main.c:506 service_flags = 1608 set_pool = 0x7646020 login_socket = 0x48494c6 "login" c = -1 #15 0x000000000040288f in ?? () No symbol table info available. #16 0x000000000462c000 in ?? () No symbol table info available. #17 0x0000000000000000 in ?? () No symbol table info available. Current language: auto; currently minimal dovecot -n # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-RC3 amd64 auth_master_user_separator = * auth_verbose_passwords = plain disable_plaintext_auth = no lmtp_save_to_detail_mailbox = yes mail_access_groups = imapmail mail_debug = yes mail_gid = imapmail mail_plugins = acl quota mail_uid = imapmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace { hidden = no inbox = no list = no location = prefix = separator = / subscriptions = yes type = private } namespace public { hidden = no list = children location = maildir:/mail/imap/ localnet.net/shared:INDEXPVT=%h/public:LAYOUT=fs:DIRNAME=DlkfdewDSD prefix = shared/ separator = / subscriptions = no type = public } namespace inbox { alias_for = hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } namespace user { list = children location = maildir:%%h/Maildir:LAYOUT=fs:DIRNAME=DlkfdewDSD:INDEXPVT=%h/shared/%%n prefix = user/%%n/ separator = / subscriptions = no type = shared } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/mail/dovecot/db/global-acls:cache_secs=300 acl_shared_dict = file:/mail/dovecot/db/shared-mailboxes quota = maildir:INBOX user/%u quota2 = maildir:Public quota:ns=shared/ quota2_rule = *:storage=100G quota_grace = 10%% quota_rule = *:storage=5G quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +editheader } protocols = imap lmtp sieve service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { chroot = drop_priv_before_exec = yes inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 0 vsz_limit = 64 M } ssl = no ssl_cert = </etc/ssl/servercerts/cert.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl quota sieve postmaster_address = postmaster(a)localnet.net } protocol imap { mail_plugins = acl quota imap_acl imap_quota }

3 2

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 25 Jul '17

25 Jul '17

> For more clarity I also attach the content of > "/etc/dovecot/conf.d/15-mailboxes.conf" > > > # mailbox Junk { > # special_use = \Junk > # } > # mailbox Trash { > # special_use = \Trash > # } > mailbox INBOX/Junk { > auto = subscribe > special_use = \Junk > } > mailbox INBOX/Trash { > auto = subscribe > special_use = \Trash > } > > Date: Mon, 24 Jul 2017 18:06:29 +0200 > From: Christian Kivalo <ml+dovecot(a)valo.at> > > Please also provide your doveconf -n Here my Dovecot configuration (I've commented out "mailbox Junk" and "mailbox Trash" above) # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.5 ext4 auth_mechanisms = plain login cram-md5 mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/server.sio4.org/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/server.sio4.org/privkey.pem ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n driver = static } protocol imap { mail_plugins = acl imap_acl mail_log notify } protocol lmtp { mail_plugins = acl sieve } Many thanks Christian!

1 0

Strange Error: Password data is not valid for scheme SHA256. Please help me resolve it.
by david.madman2＠vfemail.net 24 Jul '17

24 Jul '17

Hello, I am using version 2.2.31 (65cde28) on an Ubuntu 16.04 VPS. I am attempting to setup a mail server using a flat file system as an experiment. I am able to send e-mail from external domain names and the messages land in my /var/mail/vmail/domain/user/ directories. I am trying to setup Thunderbird as an MUA using the information I generated on my VPS namely the IMAP server, username(a)domain.com, password, and SMTP server. IMAP server - www.domain.com SMTP server - www.domain.com Username - created in /etc/postfix/virtual-mailbox-users.db and /etc/dovecot/passwd.db Password - created by dovadm pw -s SHA256 and entered (along with the username) in /etc/dovecot/passwd.db I enter this information into "new accounts" in Thunderbird and select STARTTLS with ports 143 (IMAP) and 587 (SMTP). (I have experimented with a variety of other combinations too). I click "Done" which transmits the information to the domain server to verify the details. My /var/log/mail.log shows: Jul 22 18:40:48 www dovecot: auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<wZoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32) Jul 22 18:41:00 www dovecot: message repeated 2 times: [ auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<fGoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)] Jul 22 18:41:02 www dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<test(a)domain.com>, method=PLAIN, rip=46.xxx.xxx.xxx, lip=139.xxx.xxx.xxx, TLS, session=<fGoHUuxU6IAu9j4y> What does "Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)]" mean? I assume that there is some kind of a mismatch between the way I generated the password with doveadm and entered it in passwd.db and the way I entered the non-hashed password into the password field in the new account section of Thunderbird. Is there a way to resolve this issue? My dovecot -n is below. You will note that the passdb section does have the scheme as SHA256. Many thanks. # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-83-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = plain login auth_verbose = yes mail_home = /var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=SHA256 /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/letsencrypt/live/www.domain.com/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it userdb { args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n driver = static } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster(a)domain.com quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

2 4

Re: under some kind of attack
by Joseph Tam 24 Jul '17

24 Jul '17

>> As per my post: checkpassword. You can then use one password on Mondays, >> Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday >> fetched from a rot-13 database, and only from prime numbered IP addresses >> on weekends, if that's what you want. > > Having read the wiki page on checkpassword, I am unsure how this would > work with an ldap backend. > > Could you elaborate on that? You are essentially writing your own backend by taking over authentication. You'll be accepting user/password inputs into your checkpassword executable, then use the LDAP API (or some other system that will do it for you) to authenticate. (You can Google around for code snippets.) You'll have direct control over all aspects of authentication (if/when/where/etc) that a generic backend can't provide. You can choose do implement using shell/PERL/etc script, or compile to executable from C sources. It's more work, but if you need to do everything on your wish list, I can't see any eaiser option. One of the drawbacks is that a working password depends on both time and source address, which will be adversely affect performance on a busy server as authentication data cannot be cached. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

For more clarity I also attach the content of "/etc/dovecot/conf.d/15-mailboxes.conf" # mailbox Junk { # special_use = \Junk # } # mailbox Trash { # special_use = \Trash # } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } Thanks again

2 1

failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

Hello to everyone, On Debian Jessie (no SElinux) and "dovecot-sieve 1:2.2.13-12~deb8u1" I've changed the sieve (sieve_after) Junk and Trash path, from: "INBOX.Junk" to "INBOX/Junk" compiled it: sievec /etc/dovecot/sieve-after/spam-to-folder.sieve but now if i look into mail.err log, found this: Jul 24 07:22:01 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: msgid=<887291195.6699.1500873334921.JavaMail.trend@backend-prod-003>: failed to store into mailbox 'INBOX/Junk': Permission denied Jul 24 07:22:02 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: execution of script /etc/dovecot/sieve-after/spam-to-folder.sieve failed, but implicit keep was successful and many others.. This is the "spam-to-folder.sieve content": require ["fileinto","mailbox"]; if header :contains "X-Spam-Flag" "YES" { fileinto :create "INBOX/Junk"; stop; } where I'm wrong? many thanks!

1 0

dovecot/pigeonhole and sogo
by Thomas Robers 24 Jul '17

24 Jul '17

Hello, I have two systems one with dovecot 2.2.31/Pigeonhole 0.4.19 selfcompiled through the src.rpms from ghettoforge on a CentOS 6.9 server and a second system of SOGo (3.2.9, nightly) on CentOS 7. Everything worked together until I made the update to Dovecot 2.2.31 Pigeonhole 0.4.19. Since then I get an error message when I try to upload a sieve-script. SOGo shows a message popup that "the service is temporarily not available" and in the log file of Dovecot i get: > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<25U/xB5U/KLCw8GK> > Jul 12 15:26:41 mail2 dovecot: auth: Debug: auth client connected (pid=12182) > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<4zxBxB5U/qLCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12263) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<uiR64B5UDKPCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12264) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=1192.168.1.135, TLS: Disconnected, session=<LeJ74B5UDqPCw8GK> Does this mean that managesieve-login doesn't get authentication data from SOGo? SOGo logs for this error: > S[0x7f368f2bab60]: "IMPLEMENTATION" "Dovecot Pigeonhole" > S[0x7f368f2bab60]: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" > S[0x7f368f2bab60]: "NOTIFY" "mailto" > S[0x7f368f2bab60]: "SASL" "PLAIN" > S[0x7f368f2bab60]: "VERSION" "1.0" > S[0x7f368f2bab60]: OK "Dovecot ready." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD > > S[0x7f368f2bab60]: NO "Error in MANAGESIEVE command received by server." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD Than I compiled Dovecot 2.2.31 together with Pigeonhole 0.4.18 and than everything works again as expected. I can upload and activate sieve-scripts from the SOGo webinterface. After that I tried to disable TLS for sieve with ssl = no in the 20-managesieve.conf: [...] protocol sieve { ssl = no [...] to capture the traffic between SOGo and Dovecot/Pigeonhole but then the managesieve-login process crashes: > Jul 12 16:28:32 mail2 dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 12941 killed with signal 11 (core dumps disabled) [last ip=192.168.1.138] Why isn't it possible to disable TLS for sieve and what changes between Pigeonhole 0.4.19 and 0.4.18 could be responsible for the disharmony between SOGo and Pigeonhole. I looked for 'changes' but could not find any hints regarding this problem. Is there a chance to get both work together again? And is it possible to disable TLS for sieve or why crashes the managesieve-login daemon? Any help would be welcome. TIA Thomas Robers

2 2

Modify stored mail contents?
by Evan Martin 23 Jul '17

23 Jul '17

Is there a safe way to modify the contents of emails stored by Dovecot? I'll probably only want to change the message bodies, not the headers, if that matters. Looking for ways to do this both for existing emails and new emails as they are received (though anything that works for existing emails can probably just be run again for new emails.) My mail storage is currently mdbox, but I could migrate to another format if that helps.

5 8

10-ssl ssl = no but dovecot still reads certs
by lists＠lazygranch.com 22 Jul '17

22 Jul '17

I'm bringing up a new email server starting without TLS initially. In 10-ssl.conf I set ssl = no, but the default ssl_cert and ssl_key lines are not commented out. I got the obvious error message: ------------------------------ doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 12: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot -------------------------- No big deal, but I don't remember this being an issue the last time I set up a server. You would think if ssl=no, the ssl_cert and ssl_key files would not be opened.

3 2

Re: under some kind of attack
by Joseph Tam 22 Jul '17

22 Jul '17

mj <lists(a)merit.unu.edu> wrote: > - for external users, to ONLY be allowed to use an application specific > password. (or username and password, fine as well) > > Step one: making ldap password authentication valid only from our > internal network. I though: using allow_nets=192.168.1.0/24 for that passdb > > But I can't get that to work. :-( Unsure where exactly to define the > allow_nets, tried many variations on the theme already. > > Perhaps someone can help with the step one, and also tell me if the > approach outlined above is smart, valid and do-able in dovecot. As per my post: checkpassword. You can then use one password on Mondays, Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday fetched from a rot-13 database, and only from prime numbered IP addresses on weekends, if that's what you want. Gary Sellani <lists(a)lazygranch.com> writes: > Not applicable to most installations, but I use geographical filtering > on all ports other than 25. Fine if you are the only user of the email > system. If you're the only user, moving the IMAP/POP service to a nonstandard port will do most of that with much less bother, and you won't lock yourself out, requiring a ssh/edit firewall/reconnect. Been there, done that. > I get one hacker a week trying to guess passwords, and always from Digital Ocean VPS. abuse(a)digitalocean.com is fairly responsive. They usually nuke them pretty quickly. > I would like to see statistics on the success of such brute force > attacks. They can't be very successful these days. Even if the success rate is 0.00001%, you can do the arithmetic to see that's still a huge number of accounts. But you're right, if you have anything resembling a sensible password policy, they're just a log bloating nuisance. Joseph Tam <jtam.home(a)gmail.com>

2 1

FTS error Unknown user
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, sorry for previous message, i accidentaly send it before it was complete. Recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error everytime a email is received (and FTS is not working, of course): dovecot: indexer-worker: Error: User [censored] lookup failed: Unknown user I don't fully understand why FTS needs to do any user lookup during indexing but, anyway, how can i workaround it? This is relevant config: passdb { driver = static args = password=[censored] allow_nets=[censored] } userdb { driver = static args = home=/var/mail/vhosts/%d/%n/home master_user=%u } plugin { fts = solr fts_solr = url=http://[censored]:8080/solr/ fts_autoindex = yes fts_autoindex_max_recent_msgs = 1000 } FTS is fully configured and working on proxy side (which is, currently, also a backend for most of the users - i will split it in stages, just wanted to say that i have FTS already working). azur

1 1

FTS
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error after every email is received:

1 0

Problem compiling dovecot 2.2.31 on Solaris
by Luciano Mannucci 21 Jul '17

21 Jul '17

I'm trying to compile under SunOS 5.8 Generic_117350-28 sun4u sparc SUNW,Ultra-5_10 (I know it's a bit oldish :-) and I get this error: /bin/bash ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c -o pkcs5.lo pkcs5.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c pkcs5.c -fPIC -DPIC -o .libs/pkcs5.o pkcs5.c:9:20: error: stdint.h: No such file or directory make[4]: *** [pkcs5.lo] Error 1 What have I missed? I did: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var\ --mandir=/usr/share/man --docdir=/usr/share/doc/packages/dovecot\ --disable-ipv6 --enable-header-install\ make Is it reasonable? Thanks in advance, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 6