- dovecot - dovecot.org

[Dovecot] Logging passwords on auth failure/dealing with botnets
by Michael Smith (DF) 23 Aug '13

23 Aug '13

Hi, Since upgrading our mail servers to Postfix/Dovecot, we've seen a rather large increase in botnet brute force password attacks. I guess our old servers were too slow to suit their needs. Now, when they hit upon a valid user, it's easy to see what passwords they are trying (we've enabled auth_debug_passwords and set auth_verbose_passwords = plain). We can easily have log monitors pick up the blatant password attempts (123, 1234, 12345, 3.1415926, etc) and firewall them. Aug 22 00:21:47 host1 dovecot: auth-worker(1423): sql(aea,120.198.9.221): Password mismatch (given password: 3.1415926) However, when they are plugging away on an invalid user, all the logs show is 'unknown user'. The only way to see what they are doing is to tcpdump on the box. Almost 99% of the attacks are through SMTP/SASL attempts, using 'auth login'. Postfix is configured to use Dovecot for the authentication backend. NOTE: parens contain the base64 decoded values, this is not part of the data stream. C: auth login S: 334 VXNlcm5hbWU6 (334 Username:) C: YWVi (aeb) S: 334 UGFzc3dvcmQ6 (334 Password:) C: My4xNDE1OTI2 (3.1415926) S: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6 (535 5.7.8 Error: authentication failed: Password:) Aug 22 11:00:31 host3 dovecot: auth-worker(19844): sql(aeb,120.198.9.221): unknown user How difficult would it be to add logging the given password, observing the auth_debug_passwords and auth_verbose_passwords settings, for all authentication failures? When we see certain patterns, we want to aggressively block those IPs, regardless of if it's a valid username or an unknown user. Or another option, is there any good DNS based RBLs for botnet IPs, and is there any way to tie that in to the dovecot auth system? I've been looking for botnet rbls, but what I've found so far doesn't seem to work very well. Most of the IPs that I've had to firewall don't exist in them. -- Michael Smith

3 2

Re: [Dovecot] Load goes up imap-login
by megodin＠inboxalias.com 22 Aug '13

22 Aug '13

Hi there Giles, not really a solution to your problem, but a hint: Try activating "verbose_proctitle = yes" in your dovecot.conf, restart service dovecot and you might get more information (when the load is produced by logged in users) - it gives you verbose information about which specific user with which IP is generating the high load. All the best, Megodin --- Alle PostfÃ¤cher an einem Ort. Jetzt wechseln und E-Mail-Adresse mitnehmen! http://email.freenet.de/basic/Informationen _________________________________________________________________ Send and receive anonymous emails to your inbox with InboxAlias. http://www.inboxalias.com

2 1

Re: [Dovecot] Sieve filterset not activating in Dovecot 2.0.15 with, Sieve plug-in and Roundcube 0.5.3: "NO (TRYLATER) Internal Error." (Steffen Kaiser)
by Joe Lourenco 22 Aug '13

22 Aug '13

Thank you Steffen Kaiser. I enabled the auth_debug and saw this error for permissions: Aug 22 13:41:44 managesieve($u): Error: sieve-storage: Creating symlink() /home/$u/.dovecot.sieve to sieve/Out of office.sieve failed: Permission denied The user's home directory was owned by root. Can not explain it why it was so. Thanks again! > On Wed, 21 Aug 2013, Joe Lourenco wrote: > > > roundcube: S: NO (TRYLATER) "Internal error occured. Refer to server log > > for more information. [2013-08-21 19:01:13]" > > > Nothing is showing up on the server log. > > Check out Dovecot's error log and search for that timestamp of the > message, it is there - unless, say, an out of disk error prevented the > logging. >

1 0

[Dovecot] Problem compiling 2.2.5
by Luciano Mannucci 22 Aug '13

22 Aug '13

I'm trying to upgrade a very old sparcstation running Solaris 8 which is running dovecot 1.x for few users. All I have for the task is good old gcc 2.95.2. The poor sod complains because it can't compute the sizeof(unsigned char prefix_text[]) at line 13 of log-error-buffer.c. Can I help it by - say - putting a constant between the '[]'? Or is it unfair? :-) I don't think it's woth modifying the distribution only for us owning machines that should be in a museum by now... Thanks for the good software, BTW, luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 7

[Dovecot] Load goes up imap-login
by Giles Coochey 22 Aug '13

22 Aug '13

Every so often recently I've seen the load on my heavily under-used dovecot server (1 mailbox) rise up to 1 A top shows imap-login to causing the issue. I have checked /var/log/secure, /var/log/maillog, /var/log/messages and cannot see anything unusual. Anybody else seen something like this? # 2.2.5: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-358.14.1.el6.x86_64 x86_64 CentOS release 6.4 (Final) listen = * mail_location = maildir:~/.Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/.sieve } protocols = imap service imap { process_limit = 2048 } ssl_cert = </etc/pki/dovecot/certs/imap.crt ssl_key = </etc/pki/dovecot/private/imap.key userdb { driver = passwd } protocol lmtp { mail_plugins = sieve $mail_plugins } protocol lda { mail_plugins = sieve } protocol imap { mail_max_userip_connections = 50 } -- Regards, Giles Coochey, CCNP, CCNA, CCNAS NetSecSpec Ltd +44 (0) 8444 780677 +44 (0) 7983 877438 http://www.coochey.net http://www.netsecspec.co.uk giles(a)coochey.net

1 0

[Dovecot] combining pop3 and imap accounts
by Patrick Shirkey 22 Aug '13

22 Aug '13

HI, I have a working exim4 + dovecot system that uses system user folders for the inbox. exim4: domains = dsearch;/etc/exim4/virtual dovecot: mail_location = mbox:~/mail:INBOX=/var/mail/%u - I would like to add additional virtual accounts using the method described in this post: http://www.debian-administration.org/articles/302 exim4: /etc/exim4/conf.d/router/360_exim4-local_vdom_aliases vdom_aliases_maildir: debug_print = "R: vdom_aliases_maildir for $local_part@$domain" driver = redirect allow_defer allow_fail domains = dsearch;/var/mail/virtual data = /var/mail/virtual/$domain/$local_part/ directory_transport = address_directory pipe_transport = address_pipe file_transport = address_file dovecot: mail_location = maildir:/var/mail/virtual/%d/%n/ auth_userdb = passwd-file /etc/passwd.imap - I have read about "Namespace" but I am not sure if they will work with virtual pop3 and virtual imap accounts. as I also want to keep the existing pop3 setup without have to modify the location of the inbox for existing accounts pop3 accounts. It seems that exim4 is fine with this method but I am not sure about dovecot. Is it possible to have pop3 and imap running while also using multiple delivery folder locations for the mail_location directive? -- Patrick Shirkey Boost Hardware Ltd

1 0

[Dovecot] Sieve filterset not activating in Dovecot 2.0.15 with Sieve plug-in and Roundcube 0.5.3: "NO (TRYLATER) Internal Error."
by Joe Lourenco 22 Aug '13

22 Aug '13

Hello Everyone, I am running Dovecot 2.0.15 with its Sieve plug-in, and Roundcube 0.5.3. I have a problem with just one particular user, who after creating a filters set and creating a filter in Roundcube, this user cannot activate the filters set. At first, this user could not create a filter at all. That was resolved by creating the "sieve" directory with the right permissions in his /home. Logs show the following when trying to activate the filters set via the Roundcube: roundcube: S: NO (TRYLATER) "Internal error occured. Refer to server log for more information. [2013-08-21 19:01:13]" Nothing is showing up on the server log. I have tried to activate the filter via the Sieve command line, authenticating the user, then running "SETACTIVE "roundcube"", but the error is the same, an internal server error. Again, I can successfully do this via the command line or Roundcube, from say, my userid. I appreciate any help. -- Joe Lourenco Systems Administrator C & C Technologies Cell: 55-21-8596-0078 Phone: 55-21-2499-9591

2 1

[Dovecot] dovecot2, antispam and sieve versions
by Terry Barnum 21 Aug '13

21 Aug '13

I'm currently running dovecot2 v2.2.5 with dovecot2-antispam 0.0-51 and dovecot2-sieve 0.4.1, all via macports. If one wanted to downgrade to dovecot v2.2.0, would these versions of antispam and sieve still be okay to use? The reason for the question is I'm trying to diagnose a mailserver problem where after 2-6 days the machine goes deaf. Absolutely nothing of interest in any logfile that I can see except for an imap-login process crash which got me thinking about a downgrade test. Thanks, -Terry Terry Barnum digital OutPost http://www.dop.com

1 0

[Dovecot] Dovecot antispam plugin for 2.2
by Micah Anderson 21 Aug '13

21 Aug '13

Hello, I recently was looking to update to dovecot 2.2 and I have been happily using the dovecot-antispam plugin in 2.1, but found that there have been some changes in dovecot that make this version not compile against 2.2. I'm wondering if Johannes you have any plans to update it, or if others have managed to figure out what is necessary to get it to work? The particular piece that I am currently stuck on is that the dict_init() in dovecot now requires more arguments than in previous versions, it now requires this: int dict_init(const char *uri, enum dict_data_type value_type, const char *username, const char *base_dir, struct dict **dict_r, const char **error_r); but previously, we only needed four arguments. Now we need to know what to supply for '**dict_r' and '**error_r'. Any advise/help would be appreciated: make[1]: Entering directory `/home/micah/debian/dovecot-antispam/dovecot-antispam-2.0+20120225' cc -DHAVE_CONFIG_H -I/usr/include/dovecot/ -I/usr/include/dovecot/src/ -I/usr/include/dovecot/src/lib/ -I/usr/include/dovecot/src/lib-storage/ -I/usr/include/dovecot/src/lib-mail/ -I/usr/include/dovecot/src/lib-imap/ -I/usr/include/dovecot/src/lib-dict/ -I/usr/include/dovecot/src/lib-index/ -I/usr/include/dovecot/src/imap/ -o dovecot-version dovecot-version.c ./dovecot-version > dovecot-version.h CC antispam-storage.o In file included from antispam-storage-2.2.c:20:0, from antispam-storage.c:3: antispam-plugin.h: In function ‘string_dict_init’: antispam-plugin.h:288:2: error: too few arguments to function ‘dict_init’ return dict_init(uri, DICT_DATA_TYPE_STRING, username, NULL); ^ In file included from antispam-plugin.h:13:0, from antispam-storage-2.2.c:20, from antispam-storage.c:3: /usr/include/dovecot/dict.h:34:5: note: declared here int dict_init(const char *uri, enum dict_data_type value_type, ^ micah

2 1

[Dovecot] Dsync confusion...
by Ben 21 Aug '13

21 Aug '13

Hi, Maybe I've been staring at config files and man pages too long, but the doc page for Dsync is a little confusing and I don't how to solve my problem. I've probably missed something simple and stupid, but as I said, I've been staring at this problem too long and need a second pair of eyes on it ! Per doveconf below the user/owner for auth db is a user with shell /bin/false. Root SSH login is also disabled on the target machine, so I need to use a script user to do the sync. I installed dovecot on the target host and config'd it as per the second doveconf below But all I ever get are errors such as : su -c "dsync -u test(a)somewhere.example.com backup its-virtmail(a)somewhere.example.com" its_scripts dsync(its_scripts): Fatal: setuid(1001(its-virtmail) from userdb lookup) failed with euid=1002(its_scripts): Operation not permitted (This binary should probably be called with process user set to 1001(its-virtmail) instead of 1002(its_scripts)) root@ukc-vm02-mx01:/etc/dovecot/conf.d# dsync(its_scripts): Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=1002(its_scripts) egid=1002(its_scripts) missing +r perm: /var/run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) Even if I temporarily give /bin/sh and an ssh key to the dovecot user, I still can't get it to work : ssh its-virtmail(a)somewhere.example.com dsync -u test(a)example.com dsync(its-virtmail): Error: user test(a)somewhere.example.com: Initialization failed: mail_location not set and autodetection failed: Mail storage autodetection failed with home=/srv/mail/example.com/test dsync(its-virtmail): Fatal: User init failed dsync-local(test(a)somewhere.example.com): Error: read() from worker server failed: EOF # SOURCE HOST # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.5.0-37-generic x86_64 Ubuntu 12.04.2 LTS auth_verbose = yes auth_verbose_passwords = sha1 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { fts = solr fts_solr = url=http://localhost:8080/solr/ sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = its-virtmail mode = 0660 user = its-virtmail } } service imap-login { process_min_avail = 3 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = its-virtmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieves { port = 5190 ssl = yes } process_min_avail = 3 } ssl = required ssl_cert = </etc/ssl/certs/mx_example.com.pem ssl_cipher_list = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!PSK:@STRENGTH ssl_key = </etc/ssl/private/mx_example.com.key userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 10 mail_plugins = fts fts_solr } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol lmtp { mail_plugins = sieve postmaster_address = postmaster(a)example.com } #DEST HOST # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.5.0-37-generic x86_64 Ubuntu 12.04.2 LTS auth_verbose = yes auth_verbose_passwords = sha1 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp sieve" service auth { unix_listener auth-userdb { group = its-virtmail user = its-virtmail } } service lmtp { process_min_avail = 3 user = its-virtmail } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file }

3 3