- dovecot - dovecot.org

[Dovecot] v2.2.rc5 released
by Timo Sirainen 07 Apr '13

07 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc5.tar.gz.sig One more API change that required also a Pigeonhole modification. A few other random fixes. I'm planning on making v2.2.0 release on Monday. Please test before that. :)

7 7

Re: [Dovecot] MOSTLY SOLVED: Re: client limit and STARTTLS
by Reindl Harald 07 Apr '13

07 Apr '13

Am 07.04.2013 12:36, schrieb David Benfell: > On 04/07/2013 03:15 AM, Reindl Harald wrote: >> Am 06.04.2013 10:09, schrieb David Benfell: >>> So I changed it again: >>> >>> default_process_limit = 128 default_client_limit = 512 >>> >>> And now it seems to be fine. But I'm mystified because what you >>> say is the case on your system, that is, that the process limit >>> needs to be greater than the client limit, is what I would >>> expect: wouldn't each client require at least one process? > >> no, 512x128 = 65536 connections each process can serve >> default_client_limit clients > > Thanks a million! I had no idea that was how it worked. I would think > that 65536 would be enough. ;-) http://wiki2.dovecot.org/LoginProcess High-performance mode: It works by using a number of long running login processes, each handling a number of connections. This loses much of the security benefits of the login process design, because in case of a security hole (in Dovecot or SSL library) the attacker is now able to see other users logging in and steal their passwords, read their mails, etc. Default client_limit * process_limit = 1000*100 = 100k connections vsz_limit should be increased to avoid out of memory errors, especially if you're using SSL/TLS.

1 0

[Dovecot] The sieve_extprograms plugin included in main Pigeonhole 0.4 source tree
by Stephan Bosch 06 Apr '13

06 Apr '13

Hi, I think the sieve_extprograms is mature enough for an initial release and that is why I've included the sieve_extprograms plugin into the main Pigeonhole v0.4 source tree. It is still a plugin, but is no longer provided as a separate package. This should make things easier. It will be released along with Pigeonhole v0.4.0. Regards, Stephan.

1 0

Re: [Dovecot] script to detect dictionary attacks
by Stephen Davies 06 Apr '13

06 Apr '13

Here is the simplex script that I use to filter attacking sites. I should be easy to add your extra bits (email etc). Cheers, Stephen #! /bin/sh d=`date +"%b %d"` grep "$d" /var/log/mail/info.log|grep ruleset=check_rcp | gawk '{split($0,q,/[\[\]]/);print "/sbin/iptables -A INPUT -s " q[4] "/32 -j DROP"}' | sort -u > /tmp/fw$$ #reset iptable to base /etc/rc.d/rc.fw > /dev/null 2>&1 #add new filter(s) . /tmp/fw$$ rm -f /tmp/fw$$ -- ============================================================================= Stephen Davies Consulting P/L Phone: 08-8177 1595 Adelaide, South Australia. Mobile:040 304 0583 Records & Collections Management.

1 0

[Dovecot] Released Pigeonhole v0.3.4 for Dovecot v2.1.16
by Stephan Bosch 06 Apr '13

06 Apr '13

Hello Dovecot users, Much time passed since I last released a new Pigeonhole, so quite a few unreleased fixes were pending until now. Development of new features is shifted to the upcoming Pigeonhole v0.4 for Dovecot v2.2. I intend to release v0.4.0 shortly after Dovecot v2.2.0. Changelog v0.3.4: * Changed error handling to be less of a nuisance for administrators. Strictly user-caused errors are only reported in user log. Some errors are logged as info instead. * Sieve: Changed behavior of redirect in case of a duplicate message delivery or a mail loop. If a duplicate is detected the implicit keep is canceled, as though the redirect was successful. This prevents getting local deliveries. The original SMTP recipient is used when it is available to augment the entry in the LDA duplicate database. This way, duplicates are only detected when (initially) addressed to the same recipient. + Sieve vnd.dovecot.duplicate extension: added new features to the duplicate test, making it possible to manually compose the key value for duplicate checking. This extension is in the process of being standardized: https://tools.ietf.org/html/draft-bosch-sieve-duplicate-01 + Sieve date extension: generate warning when invalid date part is specified. - Sieve editheader extension: fixed crash occurring when addheader :last was used. - Sieve include extension: fixed missing error cleanup that caused a resource leak. - Sieve vacation extension: fixed determination of From: address for when sieve_vacation_dont_check_recipient is active. - Sieve tools: the -D option wasn't enabled and documented for all tools. - Sieve dict script storage: fixed potential segfault occurring when dict initialization fails. - ManageSieve: fixed bug in skipping of CRLF at end of AUTHENTICATE command. - ManageSieve: fixed handling of unknown commands pre-login. - Fixed compile on Mageia Linux. The release is available as follows: http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.4.tar.gz http://www.rename-it.nl/dovecot/2.1/dovecot-2.1-pigeonhole-0.3.4.tar.gz.sig Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

[Dovecot] password encryption
by Jim Pazarena 06 Apr '13

06 Apr '13

I have just come to the realization that password encryption using the crypt function in linux, ONLY USES THE FIRST 8 CHARS. I have written routines using crypt allowing 16+ chars, and find that anything past 8 is ignored. Wow. Is there a way around this that can be used in dovecot, as well as encryption routines for an email front end? (not system users). It's the integration with dovecot which is the most important.

4 3

[Dovecot] not showing subfolders on INBOX
by David Benfell 05 Apr '13

05 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, Apologies if a duplicate message. I initially sent the following from a non-subscribed email address (my usual address, but not the one that works when I'm having trouble with mail). First, I'm pretty sure I screwed up something with dovecot. The symptom appears in both thunderbird and mutt. I'm moving my server from a VPS to a dedicated server. *Both* are Arch Linux systems. Here's the dovecot -n output: # 2.1.15: /etc/dovecot/dovecot.conf # OS: Linux 3.8.4-1-ARCH x86_64 base_dir = /var/run/dovecot/ default_client_limit = 3000 default_process_limit = 1000 login_trusted_networks = 10.8.0.0/16 127.0.0.0/8 mail_location = maildir:~/Maildir mail_max_userip_connections = 30 passdb { args = failure_show_msg=yes driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } ssl_cert = </home/www/ssl/www.cybernude.org_publickey-apache.pem ssl_key = </home/www/ssl/www.cybernude.org_privatekey.pem userdb { driver = passwd } One detail, the kernel version, is different from what is indicated above. munich is the new system; atlanta is the old one: Linux munich.parts-unknown.org 3.8.4-1-ARCH #1 SMP PREEMPT Wed Mar 20 22:10:25 CET 2013 x86_64 GNU/Linux Linux atlanta.parts-unknown.org 3.6.10-1-ARCH #1 SMP PREEMPT Tue Dec 11 09:40:17 CET 2012 x86_64 GNU/Linux I literally copied this configuration, so it's the same on both systems. But on the new system, I'm not seeing subfolders in INBOX. I also copied my Maildir from the old system to the new system, so it should--I thought, anyway--be okay. What did I do wrong? And how should I fix it? Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRXhA2AAoJELJhbl/uPb4STkEP/2Nx3VPh0HkZW6dN4wpwyGgG MklUzErLiA8+BM+gsEzSTASq+wWkmet9/9gSSYhgRhTbaamw+ymY+VvRzjUuMOE/ Bi1Q1QfOSe2H0AymMmO8ClQX0KeKZruf+a3ezuxL/ccYeFAoF3UmlsV5JuXzh/yS 62TknVV/mnpmikTTADSF1YkCsv11pErAPCfuXS18C1C4RivylpXdnDKANCrK1/CT E00Je3uvTzc7ed7I6QuEzZyFT7CQP49DJpYIbP7570vLHl7zFJvYSfg3IWBRqFVn iiPqQ2h9pbsxM3D4ucvuiDBM17556ep80+PXAWmc/SNEH8ArGWOGqJTjVNSnqyqP j27M15F/G68kjqp/VIaJzii6/c6C4PsB8dV5vDG/rxKmpAGr6gWrv6FZ+hkmhdQn /S+AcOeIwrqeWPEWLM4OtEt3hqjvvHtstkuw2M3iUdDdraWbzPLAT2aX2Xj7zrbc h7yRBM5G74fKXZhm3iC+6I3YeIjrzy4FGj7IxP1ubhVvbGwBInBc2h0nMX7+u/xV xTwqKomuQh4nBiZNdZ+YMkaHvN5GaiYEiO8ZOAceZZ9OYuuGg8QodsaHetWkJAcL x6SkgeYmwXTRsOaXulSdUAsLqDlaz5pV0daairRee31pJ5jOdJAPYFiDKvYFXfQN FetIUFxuPYWUxS37WpI3 =pI8L -----END PGP SIGNATURE-----

2 2

[Dovecot] manually updating dovecot 1 config to dovecot 2
by Felipe Gasper (cPanel) 04 Apr '13

04 Apr '13

Is there documentation somewhere on how to update a dovecot 1 configuration file to dovecot 2’s preferred formats? We’re looking to provide Dovecot 2 with cPanel; having that documentation would help us update the config file templates that we ship. Thank you! -- Felipe Gasper cPanel, Inc.

3 4

[Dovecot] doveadm mailbox list/stats etc. and shared mailboxes/ACLs
by Lutz Preßler 04 Apr '13

04 Apr '13

Hello, 2.2.0rc3: host:~# doveadm mailbox list -u testuser INBOX INBOX.test INBOX.bla INBOX.bla.blubb INBOX.shared INBOX.virtual INBOX.shared.user1 INBOX.shared.user1.privat INBOX.shared.user1.test INBOX.shared.user1.test.test2 INBOX.shared.user1.Trash INBOX.shared.user1.in2009 [... all mailboxes of user1] Only user1.test and user1.test.test2 have ACLs that allow testuser to access them. host:~# doveadm mailbox status -u testuser all INBOX.shared.user1.privat INBOX.shared.user1.privat messages=37 recent=0 uidnext=70 uidvalidity=1060291494 unseen=7 highestmodseq=1 vsize=1618757 guid=9a71cb399c249d4ce10e0000c93908ca Access with search and fetch (and probably any other doveadm command) is possible, too. Is this how it's supposed to work? Commands in testuser IMAP session respects ACLs. Lutz

2 3

[Dovecot] v2.2.rc4 released
by Timo Sirainen 04 Apr '13

04 Apr '13

http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc4.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.rc4.tar.gz.sig A lot of small random fixes. Some last minute major cleanups/fixes to lib-http and lib-ssl-iostream error handling, which makes them much easier to debug if something goes wrong (so e.g. if https site has invalid certificate, the caller gets error message saying that, including the part of the cert that couldn't be validated). I don't have anything important left in my v2.2 TODO. It passes all my tests. So I'm hoping for v2.2.0 release any day now. + Added "doveadm replicator" commands - Larger changes to lib-http and lib-ssl-iostream error handling. The API caller can now get the exact error message as a string. - Various bugfixes to LDAP changes in rc3

1 0