- dovecot - dovecot.org

[Dovecot] script to detect dictionary attacks
by Reindl Harald 09 Apr '13

09 Apr '13

Hi has someone a script which can filter out dictionary attacks from /var/log/maillog and notify about the source-IPs? i know about fail2ban and so on, but i would like to have a mail with the IP address for two reasons and avoid fail2ban at all because it does not match in the way we maintain firewalls * add the IP to a distributed "iptables-block.sh" and distribute it to any server with a comment and timestamp * write a abuse-mail to the ISP

8 15

[Dovecot] 2.1.16 Solaris 10 compile regression Sunstudio compiler
by Tomi Vainio 09 Apr '13

09 Apr '13

Hi, src/plugins/quota/quota-status.c won't compile due to missing include <getopt.h> needed for optarg % make source='quota-status.c' object='quota-status.o' libtool=no \ DEPDIR=.deps depmode=none /bin/bash ../../../depcomp \ cc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-master -I../../../src/lib-dict -I../../../src/lib-index -I../../../src/lib-mail -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/lib-storage/index/maildir -I../../../src/doveadm -I/usr/local/include -I/usr/sfw/include -xO4 -xtarget=ultra3cu -xcache=64/32/4:8192/512/2 -I/usr/sfw/include -c quota-status.c "../../../src/lib-storage/mailbox-list.h", line 13: warning: useless declaration "quota-status.c", line 200: undefined symbol: optarg "quota-status.c", line 200: warning: improper pointer/integer combination: arg #1 cc: acomp failed for quota-status.c *** Error code 2 make: Fatal error: Command failed for target `quota-status.o' Also 2.2.rc6 fails when using Sunstudio make but works with gmake Making all in lib-http make: Fatal error in reader: Makefile, line 725: Unexpected end of line seen Tomppa

1 0

Re: [Dovecot] make check error for Pigeonhole v0.3.4 for Dovecot v2.1.16
by Stephan Bosch 09 Apr '13

09 Apr '13

On 4/8/2013 8:16 PM, Giam Teck Choon wrote: > Hi, > > When I compile Pigeonhole v0.3.4 with Dovecot v2.1.16 until make check > output as below from my rpmbuild output: > > Test case: ./tests/extensions/mailbox/execute.svtest: > 1: Test 'MailboxExists - None exist' SUCCEEDED > 2: Test 'MailboxExists - Not all exist' SUCCEEDED > 3: Test 'MailboxExists - One exists' SUCCEEDED > 4: Test 'MailboxExists - All exist' SUCCEEDED > 5: Test ':Create' SUCCEEDED > PASS: 5 tests succeeded. > Test case: ./tests/extensions/date/basic.svtest: > 1: Test 'Defaults' SUCCEEDED > 2: Test 'Count' SUCCEEDED > 3: Test 'Invalid' SUCCEEDED > 4: Test 'Comparison' FAILED: date is invalid: 2009-07-23 > FAIL: 1 of 4 tests failed. > RPM build errors: > make: *** [tests/extensions/date/basic.svtest] Error 1 > error: Bad exit status from /var/tmp/rpm-tmp.CIcpqx (%check) > Bad exit status from /var/tmp/rpm-tmp.CIcpqx (%check) You're not the first one to notice: http://hg.rename-it.nl/dovecot-2.1-pigeonhole/rev/bc2126771d00 This is one of those genuine phase-of-the-moon kind of bugs :) Hmm, maybe I should make a new release for this problem already. Regards, Stephan.

2 1

[Dovecot] "No such file or directory" error setting up dict quota for mdbox
by ADRIAN SANTOS MARRERO 09 Apr '13

09 Apr '13

Hi, I've some troubles setting up the dict based quota plugin for mdbox, it always returns a error when lmtp tries to deliver an e-mail: Apr 8 12:40:16 mb07 dovecot: lmtp(3001, asmarre(a)ull.es) Error: fstat(/sharedfs/10.4.1.107/ull.es/54/asmarre/dovecot-quota.lock) failed: No such file or directory Apr 8 12:40:16 mb07 dovecot: lmtp(3001, asmarre(a)ull.es) Error: file dict commit: file_dotlock_open(/sharedfs/ 10.4.1.107/ull.es/54/asmarre/dovecot-quota) failed: No such file or directory Apr 8 12:40:16 mb07 dovecot: lmtp(3001, asmarre(a)ull.es) Error: dict quota: Quota update failed, it's now desynced In fact lmtp does create the dovecot-quota.lock file but it does not update the dovecot-quota file. If I run "doveadm quota recalc -u asmarre" it works and updates the dovecot-quota file. The version of dovecot that I'm using is 2.0.19 and the configuration is: # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-32-generic x86_64 Ubuntu 12.04.2 LTS mail_debug = yes mail_location = mdbox:%h mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { quota = dict:User quota::file:%h/dovecot-quota quota_rule = *:storage=1G quota_warning = storage=95%% quota-warning 95 quota_warning2 = storage=85%% quota-warning 85 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)ull.es protocols = " imap lmtp sieve pop3" service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve_deprecated { port = 2000 } } service quota-warning { executable = script /opt/ccti/correo/buzones/quota_warning.sh unix_listener quota-warning { user = dovecot } user = dovecot } ssl_cert = </etc/ssl/certs/www.ull.es.chain.crt ssl_key = </etc/ssl/private/www.ull.es.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota sieve zlib } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { pop3_no_flag_updates = yes pop3_uidl_format = %v.%u } Thanks in advance.

1 1

[Dovecot] LMTP Setup/Design Help Request
by Matthias Hofer 09 Apr '13

09 Apr '13

Hi altogether, I am switching from dbmail 2.2 to dovecot 2.1.7, and I was able to do a successful transition of IMAP. But I had a very hard time with receiving mail, and in the end -- after loads of reading and debugging -- I broke down and failed. This is why I am asking you for your kind help. I only have virtual users and have set mail_uid = dovemail mail_gid = dovemail For authentication, I simply use (for now) a flat file: passdb { driver = passwd-file args = scheme=PLAIN username_format=%u /etc/dovecot/mypasswd.file } # cat /etc/dovecot/mypasswd.file user1:{PLAIN}userpw1 user2:{PLAIN}userpw2 user3:{PLAIN}userpw3 And everything works fine with IMAP. I am completely domain-agnostic here. But I was not able to use this fine setup to receive mails with my postfix. I tried about 13 different configurations, some with considerable changes dovecot-config, the passwd-file or postfix, but I could not find a single variant working. In this situation, I would be very happy if somebody could give me a hint, which would be the prudent way to configure dovecot, LDA/LMTP and postfix based on the setup above. Thank you very much in advance, and have a great time, Matthias Hofer

3 2

[Dovecot] repeating dsync - questions
by Bob Gustafson 08 Apr '13

08 Apr '13

I'm moving/converting email from one system to another The source system is: Dual core x86_64 6GB memory 180 GB raid1 disks ext4 Fedora 9 Dovecot 1.0.15 Maildir format The destination system is: Dual core x86_64 2GB memory 1TB raid1 disks ext4 Fedora 18 Dovecot 2.1.15 sdbox format I am moving mail in a series of steps: 0) cd ( to mail user home directory ) mkdir Maildir 1) # rsync mail from source system (hoho4) to current (hoho0) time rsync -arv --times hoho4:/home/bobgus/Maildir/ /home/bobgus/Maildir/ This step takes about 37 minutes the first time 2) # dsync mirror/convert to sdbox format on current system time dsync mirror maildir:~/Maildir This step takes about 858 minutes (!!) Looking at -D messages indicates that dsync is deciding between duplicates much of the time. Looking at the results in a mail browser (Evolution), it seems fine, although the latest mails are not there. 3) # pick up more current mail - use same script as in 1) time rsync -arv --times hoho4:/home/bobgus/Maildir/ /home/bobgus/Maildir/ This step takes about 5 minutes although this varies depending on the amount of new mail. 4) # repeat the 2) dsync step time dsync mirror maildir:~/Maildir This is where things look peculiar. When I look at the directory of sdbox/mailboxes, I see duplicated directories [bobgus@hoho0 sdbox]$ cd mailboxes [bobgus@hoho0 mailboxes]$ ls Apple Mail To Do Apple Mail To Do_2a47983780615e5179600000ba55d82c Deleted Messages Deleted Messages_2847983780615e5179600000ba55d82c Drafts Drafts_2447983780615e5179600000ba55d82c Important Important_2947983780615e5179600000ba55d82c INBOX INBOX_1547983780615e5179600000ba55d82c Sent Sent_2547983780615e5179600000ba55d82c Trash Trash_2747983780615e5179600000ba55d82c The 2nd dsync step has not completed yet. I'm wondering whether the extra directory will be magically moved into the older directory. (This is unlikely because the file names are duplicated in the new directory) ------- Is this expected behavior? Are there command changes I can make to speed up the process? Eliminate the duplicate directories?

3 14

[Dovecot] dovecot 2 variables
by Pavel Dimow 08 Apr '13

08 Apr '13

Hi, I am trying to use separate configurations for ldap authentication thus providing users with the ability to only use username without domain part. Now according to documentation this should be possible http://wiki2.dovecot.org/AuthDatabase/PasswdFile but I keep getting error in my dovecot.log like this auth: Error: Can't open configuration file /etc/dovecot/%l/dovecot-ldap.conf: No such file or directory Why does dovecot does not expand %l to local ip address?

6 11

[Dovecot] dsync replication: quota counted twice
by Oli Schacher 08 Apr '13

08 Apr '13

Hi I enabled quota + warnings in my replication test setup and now whenever a mail gets delivered the quota is counted twice (probably due to both servers using the same mysql quota backend) and quota warnings are fired too early. After a doveadm quota recalc -u <username> the quota is correct again. How do I make dovecot only count the quota on the server where the mail was added originally? dovecot -n is the same as in my previous message to the list today http://www.dovecot.org/list/dovecot/2013-April/089558.html (thanks Timo for the hint in this thread btw, changing the permissions made the errors go away) Thanks Oli -- message transmitted on 100% recycled electrons

2 4

[Dovecot] Dovecot Configuration
by Andreas K. 08 Apr '13

08 Apr '13

Can somebody, please, point me in the right direction in finding a COMPLETE and EXACT definition of the Dovecot configuration hierarchy. In other words what configuration options exist both at the top level but also at each subconfiguration elements (ex. sections etc). While my C is a bit rusty, I can still make sense of source code and with a bit of effort I will figure it out. I have been going through the src/config/all-settings.c but still have large gaps. A hint in the right direction on how the config works might help clarify and speed things up. Thanks Andreas Kasenides

1 0

[Dovecot] Problem with fts lucene, on solaris 10
by Pigi 08 Apr '13

08 Apr '13

Hi all, I'm planning to migrate my courier-imap imap server to dovecot, but I'm experiencing a strange issue with fts-lucene plugin. Basically, every time I start a search, the log starts to write: Apr 05 19:30:53 indexer: Error: Indexer worker disconnected, discarding 1 requests for XXXXXX Apr 05 19:30:53 indexer-worker(XXXXX): Fatal: master: service(indexer-worker): child 809 killed with signal 11 (core not dumped) Apr 05 19:30:53 imap(XXXXXX): Error: indexer failed to index mailbox INBOX Apr 05 19:30:56 indexer-worker(XXXXX): Error: lucene index /home/XXXXX/Maildir/lucene-indexes: IndexWriter() failed (#1): Lock obtain timed out When trussing the indexer-worker pid I can see it ends with: ...SNIP... 527: brk(0x005A7840) = 0 527: brk(0x005AD840) = 0 527: pread64(16, " I G E N E R I C I < /".., 8170, 24514) = 8170 527: brk(0x005AD840) = 0 527: brk(0x005B3840) = 0 527: Incurred fault #5, FLTACCESS %pc = 0xFEBD6DDC 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA 527: Received signal #10, SIGBUS [default] 527: siginfo: SIGBUS BUS_ADRALN addr=0x005B50BA I cannot get a core, but either root ( user that is starting the dovecot ) than the user XXXXX have unlimited coresize XXXXX /home/XXXXXXX > ulimit -a time(seconds) unlimited file(blocks) unlimited data(kbytes) unlimited stack(kbytes) 8192 coredump(blocks) unlimited nofiles(descriptors) 256 vmemory(kbytes) unlimited root # ulimit -a core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited The mailbox for user XXXXXX ( Maildir stile, for speed-up migration ) has ~ 4000 messages. The search ends, but I think it don't use the lucene plugin ( it crashes ). I'm sure I'm missing something, but I can't really find what. All stuff have been self compiled, using standard flags as per "configure" scripts. Thanks for any hint. Pigi here the environment: uname -a SunOS puma 5.10 Generic_137137-09 sun4u sparc SUNW,Sun-Fire-V240 ( yes, I know, it's quite old ;) ) ======= dovecot --version 2.1.15 ======= doveconf -n # 2.1.15: /usr/local/dovecot/etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u debug_log_path = /usr/local/dovecot/var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /usr/local/dovecot/var/log/dovecot-info.log log_path = /usr/local/dovecot/var/log/dovecot.log mail_location = maildir:~/Maildir mail_plugins = " fts fts_lucene" namespace { inbox = yes location = prefix = INBOX. separator = . } passdb { driver = pam } plugin { fts = lucene fts_lucene = whitespace_chars=@. } service imap-login { inet_listener imap { port = 144 } } service indexer-worker { drop_priv_before_exec = yes } service pop3-login { inet_listener pop3 { port = 112 } } ssl = no userdb { driver = passwd } ============= gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ============= clucene clucene-core-2.3.3.4 libstemmer_c libtextcat-2.2 openssl-1.0.1e

2 6

[Dovecot] checkpassword protocol
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi, I'm writing a checkpassword script in order to support our OTP token as a fallback for client certificate authentication. Here are two questions: 1) It seems to me that the username and the password will be delivered to my script both on file descriptor 3 and via the environment variables AUTH_USER and AUTH_PASSWORD. May I ignore file descriptor 3 and use the environment variables or may it happen that these variables will have differnet content from what is sent via fd 3? 2) There seems to be some undocumented interaction between dovecot and my script via file descriptor 4. Seems that whatever I write to fd 4 will show up in syslog (unless it contains newlines). Can I use this "feature" to send error messages from my script to dovecot? What data does dovecot expect on fd 4? Peter

3 5

[Dovecot] ssl_require_crl does not work as expected
by dovecot.pkoch＠dfgh.net 08 Apr '13

08 Apr '13

Hi I'm trying to use dovecot with client certificates. We produce our certificates with our on CA and we do NOT use certificate revocation lists. So I put "ssl_require_crl = no" into 10-ssl.conf. I did not find a solution neither in the wiki nor somewhere else, so I finally started to read the source. My impression is that openssl will always try to use CRLs. If "ssl_require_crl = no" dovecot will use CRLs but tries to ignore openssl error codes X509_V_ERR_UNABLE_TO_GET_CRL and X509_V_ERR_CRL_HAS_EXPIRED. This is done in ssl_verify_client_cert() in ssl-proxy-openssl.c line 871, namely i_info("proxy=%d, require_crl=%d, error=%d", proxy->client_proxy, proxy->set->ssl_require_crl, ctx->error ); if (proxy->client_proxy && !proxy->set->ssl_require_crl && (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL || ctx->error == X509_V_ERR_CRL_HAS_EXPIRED)) { /* no CRL given with the CA list. don't worry about it. */ preverify_ok = 1; } With my setup proxy->client_proxy is 0. I added the i_info() to check this and with this modification my syslog shows: Apr 7 13:01:16 d600 dovecot: master: Dovecot v2.1.15 starting up (core dumps disabled) Apr 7 13:01:21 d600 dovecot: auth: Debug: Loading modules from directory: /usr/dovecot/lib/dovecot/auth Apr 7 13:01:21 d600 dovecot: auth: Debug: auth client connected (pid=26175) Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...user cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=...intermedieate cert.../C=DE Apr 7 13:01:22 d600 dovecot: imap-login: proxy=0, require_crl=0, error=3 Apr 7 13:01:22 d600 dovecot: imap-login: Invalid certificate: unable to get certificate CRL: /CN=Root-CA.../C=DE I dont know what the proxy-stuff is about so instead of ignoring CRL-related errors I tried to disable CRL-checking. I therefore commented out two lines in ssl_proxy_ctx_verify_client() in ssl-proxy-openssl.c line 1004, namely: // X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | // X509_V_FLAG_CRL_CHECK_ALL); This tells OpenSSL not to check CRLs. Of course in production code this should be done only if "ssl_require_crl = no". Similar code is contained in iostream-openssl-context.c, namely in routine ssl_iostream_ctx_verify_remote_cert() Is this a bug? Peter

2 1

[Dovecot] client limit and STARTTLS
by David Benfell 08 Apr '13

08 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm migrating from one system to another. Both are Arch Linux, but copying the configurations and just modifying them for IP addresses and hostnames didn't work. Here's doveconf -n # 2.1.15: /etc/dovecot/dovecot.conf doveconf: Warning: service auth { client_limit=256 } is lower than required under max. load (3072) doveconf: Warning: service anvil { client_limit=256 } is lower than required under max. load (2051) # OS: Linux 3.8.4-1-ARCH x86_64 base_dir = /var/run/dovecot/ default_client_limit = 256 default_process_limit = 1024 login_trusted_networks = 10.8.0.0/16 127.0.0.0/8 mail_location = maildir:~/Maildir mail_max_userip_connections = 30 passdb { args = failure_show_msg=yes driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </big/www/ssl/www.cybernude.org_publickey.pem ssl_key = </big/www/ssl/www.cybernude.org_privatekey.pem userdb { driver = passwd } Obvious first question: I can't figure out how to make dovecot happy with the client and process limits. I'm not terribly worried about going overboard here, though I have a very small number of users; the migration is to a much more capable system. But I would like to stop looking at the warning. It doesn't seem to matter what I put where--it keeps complaining. Second question: STARTTLS isn't working. What am I missing? Sorry if this is something that should be obvious; I'm fighting a similar battle with postfix and I'm being pushed around the bend while I really need to be working on other things. Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRXy6nAAoJELJhbl/uPb4SsTAQALIkmDwCwPlCNPtJr482lVNj vsNHX4TvTy0Xu4adtxFqJQM30EoEpu4A983CTm81jUFYKqDIBRJ3SAVOGf58lCQ1 uJhoyL0yhCaO9Zh7WZKdmhB+Jnek2+Rz2cpfOP4VseLL7Lg3OIwI4K/YiDAIcwnW do/tvuJEL6SDDcDA3gOjDJ7gkykg34tJ02nnG65Yau0y563FT7npXKFnwGSn1X0+ GTFUwpZx5xp90eUZBLoTBPcnXohKlWhYxa2POHgm7eraK8k+aD9/2zlThQL6/qIx HQKcSkZjB1CTgKGysp+msaR/gS5HiHILadB3opP8p7baGNG9jhifKE6LJavREH8p PsxxCpTnf8d+xbbJVeDx6cyz7NQ8rNLals1qtPLAY4F04Uh400FjJov/dJruBISZ QvASZPOtyZHuswUnSTtX22WOg2QIvyO5GyzqPGZ/0+MtgbtJxwizsyCTEFuTkq+r RvsW1cltVsDKCFCCcjrkRzWu+xbDrkX42tNUnhi4YSJ5wcKQMRiqQBTtyCYT88sy Ws9WtNaElOERxQeydmizvxIuFIoLapdPtfyRDSGoDOo0Cnq/QSIzvQNdOVbqqSBt hcIVDNHTw8O5UfOhhbo+YT8QIBwD8J/uPxLfV72ep7nQBJh8XOymHJXGtQR8+H4x 6aey6+bafQ/YHtuS63bz =4qNn -----END PGP SIGNATURE-----

4 4

[Dovecot] v2.2.rc6 released
by Timo Sirainen 08 Apr '13

08 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc6.tar.gz.sig Some more fixes to bugs I noticed today while trying out some new things in production. Note especially the replicator-doveadm socket change, see http://wiki2.dovecot.org/Replication for how to configure it. This change allowed local replicator to notify the remote replicator about user being synced. * replicator: Don't create replicator-doveadm socket by default. This way doveadm replicator commands don't accidentally start an unconfigured replicator server. + replicator: Have remote dsync notify the remote replicator that a user was just synced. This way the replicators are kept roughly in sync. + Added ssl_client_ca_file to specify the CA certs as a file. This is needed (instead of ssl_client_ca_dir) in RedHat-based systems. + Added "doveadm fs" commands, mainly to debug lib-fs backends. - Mailbox list indexes weren't using proper file permissions based on the root directory.

2 2

[Dovecot] mdbox and folders containing both messages and sub-folders
by Rich Wales 08 Apr '13

08 Apr '13

I've got Dovecot 2.2r5 (Ubuntu package version 2:2.2.0~rc5-0~auto+1 from the "testing-auto/dovecot-2.2" repository on xi.rename-it.nl) running on a brand-new Ubuntu 12.04.2 server. I'm trying to configure Dovecot (using the "mdbox" mailbox format) to allow folders to contain both messages and sub-folders. However, it's not working consistently. I need to have folders with both messages and sub-folders because I'm trying to migrate mail from an existing (but soon-to-be-retired) Cyrus server, and the existing body of mail has folders of this sort. I'm currently using the following configuration line: mail_location = mdbox:~/mdbox:DIRNAME=.indexes:INDEX=~/mdbox/indexes and am using the Larch program to do an IMAP-to-IMAP copy of one of my family member's mail from the old Cyrus server to the new Dovecot server. When I examine the "mailboxes" directory tree, I see some directories that (correctly) contain both the renamed ".indexes" directory and also directories for IMAP subfolders. However, the Larch output is showing many errors of the form "mailbox cannot contain messages", and some of the messages could not be migrated because of this problem. Am I doing something wrong? Or is the "folders containing both messages and sub-folders" feature simply broken for the "mdbox" format -- meaning presumably that I'll be forced either to use the Maildir format, or else abandon Dovecot entirely and install Cyrus on my new mail server instead? Rich Wales richw(a)richw.org

7 14

[Dovecot] autocreate mailbox but no sub folders
by Arnaud Abélard 08 Apr '13

08 Apr '13

Hello, We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+folder(a)domain.tld) It's easy for a malicious user to flood a mailbox with tons of subfolders. Is there a way to tell dovecot-lda it can only create the initial mailbox and maybe some special folders but nothing else? Thanks, Arnaud -- Arnaud Abélard jabber: arnaud.abelard(a)univ-nantes.fr / twitter: ArnY Administrateur Système DSI Université de Nantes -

2 1

[Dovecot] replicator/dsync over tcp
by Michael Grimm 08 Apr '13

08 Apr '13

Hi -- I am testing replicator/dsync over tcp, and I did run into some issues. First of all I did need to extend http://wiki2.dovecot.org/Replication to get dsync over tcp running without ssl: | # dsync over tcp default port | # | doveadm_port = 12345 | service doveadm { | # running dsync over tcp and using ssl | # added-->| user = vmail | inet_listener { added-->| address = 1.2.3.4 | port = 12345 | # ssl = yes | } | } | plugin { | # this host replicates to remote host | # | mail_replica = tcp:SERVER-A.TLD That didn't work ... | dovecot: doveadm(test): Error: doveadm_password not set, can't authenticate to remote server ... thus, I needed to add: added-->| local 1.2.3.4 { added-->| # password for client authentication by doveadm server added-->| # added-->| doveadm_password = secret added-->| # allow client to only use specified list of commands (default is all): added-->| # added-->| #doveadm_allowed_commands = added-->| } 1. Question: may one include "secret" from a file? Well, that runs like a charm! Now, I did try to add ssl by activating "ssl = yes" in 'service doveadm' (see above) and adding ... | # used by replicator/dsync over tcp | # | ssl_client_ca_dir = /<path-to>/ssl/certs ... and ... | mail_replica = tcps:SERVER-A.TLD But, this didn't work (logfile at remote server): | dovecot: doveadm(test): Invalid certificate: self signed certificate: /OU=dovecot server/CN=OTHER-NAME.TLD/emailAddress=postmaster(a)OTHER-NAME.TLD | dovecot: doveadm(test): Error: SERVER-A.TLD: Received invalid SSL certificate | dovecot: doveadm(test): Error: sync: Disconnected from remote The OTHER-NAME.TLD is served by my additional settings used by my MUAs: | ssl_cert = </<path-to>/ssl/certs/OTHER-NAME.TLD.pem | ssl_key = </<path-to>/ssl/private/OTHER-NAME.TLD.pem I did supply SERVER-A.TLD certs and private certificates at both servers as well, but dovecot seems to use those of OTHER-NAME.TLD for replicator/dsync instead :-( 2. Question: May I config the certificate that should be used for replicator/dsync and that might be different from those used by my MUAs (other then pointing to '/<path-to>/ssl/certs')? I am quite sure that I screwed my config somehow, but I cannot find the cause. Thus, someone? Thanks, and with kind regards, Michael

2 4

[Dovecot] v2.1.16 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz http://dovecot.org/releases/2.1/dovecot-2.1.16.tar.gz.sig + Added quota-status policy service for Postfix + Added "doveadm batch" command to run multiple commands before moving onto the next user (useful only with -A and -u <usermask>) + Added forwards compatibility for v2.2 index files - mdbox: Index rebuilding crashed in some situations - Fixed a race condition with setting \Recent flags - Fixed a crash when decoding a specific message (decoding is done for SEARCH TEXT/BODY and with full text search indexing, so this couldn't fully DoS a user)

7 24

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > * Andreas Meyer <anmeyer(a)anup.de>: > > > Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. > > Gut. > > > Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) > > Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de > > Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] > > Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> > > Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] > > Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] > > Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Na dann sind deine Restrictions falsch und die Mail wird "OK"'ed bevor > der Policy Server gefragt wird. > > > Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 > > ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich > > den check am Ende hatte noch nach postgrey. > > > > smtpd_recipient_restrictions = > > ---> hier einbauen <--- > ist ja nur zum Test > > > check_sender_access hash:/etc/postfix/access_sender, > > permit_mynetworks, > > permit_sasl_authenticated, > > reject_invalid_helo_hostname, > > reject_unlisted_recipient, > > warn_if_reject check_policy_service inet:127.0.0.1:12340 > > reject_unknown_sender_domain, > > check_sender_access pcre:/etc/postfix/umlaute.pcre, > > check_recipient_access pcre:/etc/postfix/umlaute.pcre, > > reject_unauth_destination, > > reject_rbl_client bl.spamcop.net, > > reject_rbl_client zen.spamhaus.org, > > check_client_access cidr:/etc/postfix/client.cidr, > > check_policy_service inet:127.0.0.1:10023 That did the trick! The order of the recipient_restricitons was wrong. Apr 7 20:24:55 delta postfix/smtpd[23806]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:55 delta postfix/smtpd[23806]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:24:56 delta postfix/smtpd[23806]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 552 5.2.2 <miles(a)anup.de>: Recipient address rejected: Quota exceeded (mailbox for user is full); from=<anmeyer(a)anup.de> to=<miles(a)anup.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:24:56 delta postfix/smtpd[23806]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:24:56 delta postfix/smtpd[23806]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] The MUA does not get rid of the mail, when it would exceed the quota. But now the next problem. I cannot send this mail and get the following with smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:12340 check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, .... Apr 7 20:31:43 delta postfix/smtpd[23820]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:44 delta postfix/smtpd[23820]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:45 delta postfix/smtpd[23820]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 20:31:46 delta postfix/smtpd[23820]: warning: problem talking to server 127.0.0.1:12340: Success Apr 7 20:31:46 delta postfix/smtpd[23820]: NOQUEUE: reject: RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201]: 451 4.3.5 Server configuration problem; from=<anmeyer(a)anup.de> to=<dovecot(a)listen.jpberlin.de> proto=ESMTP helo=<itxnew.bitcorner.intern> Apr 7 20:31:46 delta postfix/smtpd[23820]: lost connection after RCPT from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 20:31:46 delta postfix/smtpd[23820]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] the mail is not sent out. I deactivated the check to get sent mail sent. Andreas

1 0

[Dovecot] IDLE and inactivity
by Andreas Meyer 07 Apr '13

07 Apr '13

Good day! Apr 07 10:59:40 imap(anmeyer(a)anup.de): Info: Disconnected: Disconnected in IDLE in=725 out=2546 Apr 07 10:59:59 imap(anmeyer(a)anup.de): Info: Disconnected for inactivity in=952 out=25789 Please someone explain to me the IDLE state and the inactivity state an what the numbers at in= and out= means! Andreas

2 1

Re: [Dovecot] [Dovecot-de] Dovecot Quota via policy service abfragen
by Andreas Meyer 07 Apr '13

07 Apr '13

Hallo Waffenmeister! Ralf Hildebrandt <Ralf.Hildebrandt(a)charite.de> wrote: > > Apr 7 14:07:52 delta postfix/qmgr[19078]: 1D8921B31260: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) > > Apr 7 14:07:53 delta postfix/pipe[19091]: 1D8921B31260: to=<miles(a)anup.de>, relay=dovecot, delay=2542, delays=2542/0.01/0/0.29, dsn=4.3.0, status=deferred (temporary failure) > > Ich sehe hier nur einen Fehler vom transport "dovecot". > > > plugin { > > quota = maildir:User quota > > quota_grace = 10%% > > quota_rule = *:storage=500MB > > quota_rule2 = Trash:storage=+10%% > > > > quota_status_success = DUNNO > > quota_status_nouser = DUNNO > > quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll > > Lass mal das quota_status_overquota feld weg. Habe ich jetzt neben quota_grace = 10%% auch rausgenommen. Apr 7 19:38:35 delta postfix/smtpd[23037]: connect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: setting up TLS connection from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:38:36 delta postfix/smtpd[23037]: TLS connection established from p54B32BC9.dip.t-dialin.net[84.179.43.201]: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Apr 7 19:38:37 delta postfix/smtpd[23037]: NOQUEUE: client=p54B32BC9.dip.t-dialin.net[84.179.43.201], sasl_method=CRAM-MD5, sasl_username=anmeyer(a)anup.de Apr 7 19:39:01 delta postfix/smtpd[23139]: connect from localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/smtpd[23139]: 9C1BA1B30FB0: client=localhost[127.0.0.1] Apr 7 19:39:01 delta postfix/cleanup[23142]: 9C1BA1B30FB0: message-id=<20130407193818.62d8c328(a)itxnew.bitcorner.intern> Apr 7 19:39:01 delta postfix/qmgr[22234]: 9C1BA1B30FB0: from=<anmeyer(a)anup.de>, size=1492149, nrcpt=1 (queue active) Apr 7 19:39:01 delta postfix/smtpd[23139]: disconnect from localhost[127.0.0.1] Apr 7 19:39:02 delta postfix/smtpd[23037]: disconnect from p54B32BC9.dip.t-dialin.net[84.179.43.201] Apr 7 19:39:02 delta postfix/pipe[23143]: 9C1BA1B30FB0: to=<miles(a)anup.de>, relay=dovecot, delay=0.56, delays=0.33/0/0/0.23, dsn=4.3.0, status=deferred (temporary failure) > > Also ich vermisse das reject-warning von postfix und es hat auch nicht den > > Anschein, dass postfix den Status der Quota bei dovecot über port 12340 > > abfrägt. > > Naja, vielleicht steht es an der falschen Stelle in den Restrictions! > Das muss passieren BEVOR irgendwas ein OK zurückgibt. Ich habe warn_if_reject check_policy_service inet:127.0.0.1:12340 ziemlich am Anfang der recipient_restrictions gesetzt nachdem ich den check am Ende hatte noch nach postgrey. smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/access_sender, permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_unlisted_recipient, warn_if_reject check_policy_service inet:127.0.0.1:12340 reject_unknown_sender_domain, check_sender_access pcre:/etc/postfix/umlaute.pcre, check_recipient_access pcre:/etc/postfix/umlaute.pcre, reject_unauth_destination, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, check_client_access cidr:/etc/postfix/client.cidr, check_policy_service inet:127.0.0.1:10023 Andreas

1 0

[Dovecot] v2.2.rc5 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz.sig One more API change that required also a Pigeonhole modification. A few other random fixes. I'm planning on making v2.2.0 release on Monday. Please test before that. :)

7 7

Re: [Dovecot] MOSTLY SOLVED: Re: client limit and STARTTLS
by Reindl Harald 07 Apr '13

07 Apr '13

Am 07.04.2013 12:36, schrieb David Benfell: > On 04/07/2013 03:15 AM, Reindl Harald wrote: >> Am 06.04.2013 10:09, schrieb David Benfell: >>> So I changed it again: >>> >>> default_process_limit = 128 default_client_limit = 512 >>> >>> And now it seems to be fine. But I'm mystified because what you >>> say is the case on your system, that is, that the process limit >>> needs to be greater than the client limit, is what I would >>> expect: wouldn't each client require at least one process? > >> no, 512x128 = 65536 connections each process can serve >> default_client_limit clients > > Thanks a million! I had no idea that was how it worked. I would think > that 65536 would be enough. ;-) http://wiki2.dovecot.org/LoginProcess High-performance mode: It works by using a number of long running login processes, each handling a number of connections. This loses much of the security benefits of the login process design, because in case of a security hole (in Dovecot or SSL library) the attacker is now able to see other users logging in and steal their passwords, read their mails, etc. Default client_limit * process_limit = 1000*100 = 100k connections vsz_limit should be increased to avoid out of memory errors, especially if you're using SSL/TLS.

1 0

[Dovecot] The sieve_extprograms plugin included in main Pigeonhole 0.4 source tree
by Stephan Bosch 07 Apr '13

07 Apr '13

Hi, I think the sieve_extprograms is mature enough for an initial release and that is why I've included the sieve_extprograms plugin into the main Pigeonhole v0.4 source tree. It is still a plugin, but is no longer provided as a separate package. This should make things easier. It will be released along with Pigeonhole v0.4.0. Regards, Stephan.

1 0

Re: [Dovecot] script to detect dictionary attacks
by Stephen Davies 07 Apr '13

07 Apr '13

Here is the simplex script that I use to filter attacking sites. I should be easy to add your extra bits (email etc). Cheers, Stephen #! /bin/sh d=`date +"%b %d"` grep "$d" /var/log/mail/info.log|grep ruleset=check_rcp | gawk '{split($0,q,/[\[\]]/);print "/sbin/iptables -A INPUT -s " q[4] "/32 -j DROP"}' | sort -u > /tmp/fw$$ #reset iptable to base /etc/rc.d/rc.fw > /dev/null 2>&1 #add new filter(s) . /tmp/fw$$ rm -f /tmp/fw$$ -- ============================================================================= Stephen Davies Consulting P/L Phone: 08-8177 1595 Adelaide, South Australia. Mobile:040 304 0583 Records & Collections Management.

1 0