- dovecot - dovecot.org

[Dovecot] 2.1 Plans
by Steve Fatula 18 Oct '11

18 Oct '11

Back in early 2010, Timo posted about a potential 2.1 feature to in essence reduce the number of imap/pop3 processes using various techniques since the code already supports multiple connections. It even went as far as moving all idle connections. I don't see this on the 2.1 roadmap. Is it still planned perhaps for 2.1? Thousands of imap processes going away is a great thing for me! So, just curious. Reference: http://dovecot.org/list/dovecot/2010-January/046148.html Steve

2 1

[Dovecot] Convert-tool maildir > mbox
by Bertrand Jacquin 18 Oct '11

18 Oct '11

Timo, Is seems that this commit broke convertion from Maildir to Mbox using dovecot 1.2 convert-tool binary : 2009-07-09 Timo Sirainen <tss(a)iki.fi> * src/plugins/convert/convert-storage.c: convert plugin: Fixed changing hierarchy separators in mailbox names when alt_hierarchy_char isn't set. [a9f719f9a509] <HEAD> Since, I get the following : $ convert-tool user1 /var/mail/example.com/user1 Maildir:/var/mail/example.com/user1 mbox:/var/mail/example.com/user1-mbox alt_hierarchy_char=_ Error: Mailbox conversion: Couldn't create mailbox Sent/test: Mailbox doesn't allow inferior mailboxes Error: Internal failure Strace give show me a failure after : access("/var/mail/example.com/user1/.Sent.test/cur", W_OK) = 0 stat("/var/mail/example.com/user1-mbox/Sent/test", 0x7fff843e73b0) = -1 ENOTDIR (Not a directory) write(2, "Error: Mailbox conversion: Couldn"..., 103Error: Mailbox conversion: Couldn't create mailbox Sent/test: Mailbox doesn't allow inferior mailboxes ) = 103 lstat("/var/mail/example.com/user1/.dovecot.convert.lock", {st_mode=S_IFREG|0644, st_size=12, ...}) = 0 unlink("/var/mail/example.com/user1/.dovecot.convert.lock") = 0 Is that somethinh known ? Didn't find anything interesting in archives. Maybe that kind of conversion have evolved since 2.0 ? Thanks, Beber

2 1

[Dovecot] doveadm mailbox list shows file system directories as mailboxes
by Jürgen Obermann 18 Oct '11

18 Oct '11

Hello. In our dovecvot we use mbox format with the default filesystem layout. Therefore it is not possible to have mailboxes which are subfolders of other mailboxes containing messages. The command "doveadm mailbox list" includes the file system directories, that contain only subfolders, as normal mailboxes in the output: archiv archiv/daemon archiv/dovecot Did I miss something in the dovecot configuration or is there a bug in the command "doveadm mailbox list"? # 2.0.13: /opt/local/etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4v auth_verbose = yes disable_plaintext_auth = no listen = imap.hrz.uni-giessen.de localhost mail_fsync = always mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = mail_log notify managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mmap_disable = yes namespace { inbox = yes location = prefix = separator = / type = private } namespace { hidden = yes list = no location = prefix = Mail/ separator = / subscriptions = yes type = private } Thanks, Jürgen -- Hochschulrechenzentrum der | Mail: Juergen.Obermann(a)hrz.uni-giessen.de Justus-Liebig-Universitaet | WWW: http://www.uni-giessen.de/obermann/ Heinrich-Buff-Ring 44 | Tel: 0641-99-13054 (0641-99-13001) D-35392 Giessen, Germany | Fax: 0641-99-13009

3 2

Re: [Dovecot] Spammers attempting SASL Auth
by Tom Pawlowski 17 Oct '11

17 Oct '11

Take a look at: http://hg.dovecot.org/dovecot-2.0/file/962df5d9413a/src/auth/auth-request.c on line 536. That's the auth service catching illegal characters and rejecting the attempt. It'll happen with or without a valid user. So, working as it should. As for spammers trying to brute force valid logins, yep, pretty common. Higher rate of success if they can mail from a known good server and account. * Simon Brereton <simon.brereton(a)buongiorno.com> [2011-10-17 11:51:15 -0400]: > On 17 October 2011 11:31, Robert Schetterer <robert(a)schetterer.org> wrote: > > Am 17.10.2011 17:16, schrieb Simon Brereton: > >> Hi > >> > >> This is a new one on me - I've never seen spammers attempt to use to SASL Auth to inject spam. None of the users they are trying (newsletter, dummy, test, etc.) exist, but what worries me is the illegal chars error - is this a known vulnerability in dovecot they are trying to exploit? I'm running 1:1.2.15-7 installed from apt-get.. > >> > >> Oct 17 15:07:16 mail postfix/smtpd[14422]: connect from unknown[208.86.147.92] > >> Oct 17 15:07:16 mail dovecot: auth(default): passdb(newsletter(a)mydomain.net,208.86.147.92): Attempted login with password having illegal chars > >> Oct 17 15:07:17 mail dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<test(a)mydomain.net>, method=PLAIN, rip=208.86.147.92, lip=83.170.64.84 > >> Oct 17 15:07:18 mail postfix/smtpd[14403]: warning: 208.86.147.92: hostname default-208-86-147-92.nsihosting.net verification failed: Name or service not known > >> > >> > >> Simon > >> > > > > this maybe a brute force attack,or more easy someone missconfigured his > > client , you may use fail2ban etc to block it > > not directly related to dovecot > > 17 queries in 30 seconds is not a misconfigured client :) > > And I'm already using Fail2Ban - but as someone on this list pointed > out recently, that doesn't apply if they try X attempts on the same > connection. Although, I don't think that was case here - maybe I > should update my dovecot jail with that illegal chars line. But, be > that as it may - all these attempts failed because the user didn't > exist. What if the user exists though? Does this illegal chars make > a hole for them to enter through? > > Simon > -- Tom Pawlowski OIT-CSS System Administrator office: Hill 147 email: tompru(a)jla.rutgers.edu phone: (732) 445-2634

2 1

Re: [Dovecot] Spammers attempting SASL Auth
by Robert Schetterer 17 Oct '11

17 Oct '11

Am 17.10.2011 17:51, schrieb Simon Brereton: > On 17 October 2011 11:31, Robert Schetterer <robert(a)schetterer.org> wrote: >> Am 17.10.2011 17:16, schrieb Simon Brereton: >>> Hi >>> >>> This is a new one on me - I've never seen spammers attempt to use to SASL Auth to inject spam. None of the users they are trying (newsletter, dummy, test, etc.) exist, but what worries me is the illegal chars error - is this a known vulnerability in dovecot they are trying to exploit? I'm running 1:1.2.15-7 installed from apt-get.. >>> >>> Oct 17 15:07:16 mail postfix/smtpd[14422]: connect from unknown[208.86.147.92] >>> Oct 17 15:07:16 mail dovecot: auth(default): passdb(newsletter(a)mydomain.net,208.86.147.92): Attempted login with password having illegal chars >>> Oct 17 15:07:17 mail dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<test(a)mydomain.net>, method=PLAIN, rip=208.86.147.92, lip=83.170.64.84 >>> Oct 17 15:07:18 mail postfix/smtpd[14403]: warning: 208.86.147.92: hostname default-208-86-147-92.nsihosting.net verification failed: Name or service not known >>> >>> >>> Simon >>> >> >> this maybe a brute force attack,or more easy someone missconfigured his >> client , you may use fail2ban etc to block it >> not directly related to dovecot > > 17 queries in 30 seconds is not a misconfigured client :) > > And I'm already using Fail2Ban - but as someone on this list pointed > out recently, that doesn't apply if they try X attempts on the same > connection. Although, I don't think that was case here - maybe I > should update my dovecot jail with that illegal chars line. But, be > that as it may - all these attempts failed because the user didn't > exist. What if the user exists though? Does this illegal chars make > a hole for them to enter through? > > Simon > as i posted you offlist, this is a smtp attack, look at your i.e fail2ban postfix rules, fail2ban dovecot ruel is for banning pop3/imap brute force -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

1 0

Re: [Dovecot] Spammers attempting SASL Auth
by Robert Schetterer 17 Oct '11

17 Oct '11

Am 17.10.2011 17:16, schrieb Simon Brereton: > Hi > > This is a new one on me - I've never seen spammers attempt to use to SASL Auth to inject spam. None of the users they are trying (newsletter, dummy, test, etc.) exist, but what worries me is the illegal chars error - is this a known vulnerability in dovecot they are trying to exploit? I'm running 1:1.2.15-7 installed from apt-get.. > > Oct 17 15:07:16 mail postfix/smtpd[14422]: connect from unknown[208.86.147.92] > Oct 17 15:07:16 mail dovecot: auth(default): passdb(newsletter(a)mydomain.net,208.86.147.92): Attempted login with password having illegal chars > Oct 17 15:07:17 mail dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<test(a)mydomain.net>, method=PLAIN, rip=208.86.147.92, lip=83.170.64.84 > Oct 17 15:07:18 mail postfix/smtpd[14403]: warning: 208.86.147.92: hostname default-208-86-147-92.nsihosting.net verification failed: Name or service not known > > > Simon > this maybe a brute force attack,or more easy someone missconfigured his client , you may use fail2ban etc to block it not directly related to dovecot -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

2 1

[Dovecot] Spammers attempting SASL Auth
by Simon Brereton 17 Oct '11

17 Oct '11

Hi This is a new one on me - I've never seen spammers attempt to use to SASL Auth to inject spam. None of the users they are trying (newsletter, dummy, test, etc.) exist, but what worries me is the illegal chars error - is this a known vulnerability in dovecot they are trying to exploit? I'm running 1:1.2.15-7 installed from apt-get.. Oct 17 15:07:16 mail postfix/smtpd[14422]: connect from unknown[208.86.147.92] Oct 17 15:07:16 mail dovecot: auth(default): passdb(newsletter(a)mydomain.net,208.86.147.92): Attempted login with password having illegal chars Oct 17 15:07:17 mail dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<test(a)mydomain.net>, method=PLAIN, rip=208.86.147.92, lip=83.170.64.84 Oct 17 15:07:18 mail postfix/smtpd[14403]: warning: 208.86.147.92: hostname default-208-86-147-92.nsihosting.net verification failed: Name or service not known Simon

1 0

[Dovecot] dovecot-antispam – Debian package
by Philipp Haselwarter 17 Oct '11

17 Oct '11

Dovecot2 has been around for a bit now but Eugene Paskevich's antispam plugin unfortunately still doesn't seem to have a tagged release. Has anyone by any chance rolled a .deb for the plugin that works on current Debian sid? -- Philipp Haselwarter

1 0

[Dovecot] lmtp performance
by Juan Carlos Sanchez 17 Oct '11

17 Oct '11

Hello: In the process of migration from version 1.2 to 2.0 have tried to use lmtp instead of lda as delivery agent. But unfortunately througput we get is poor with lmtp compared to lda. In peak times with lda we are able to deliver over 1800 messages/minute (high I/O but not affecting service) but if we switch to lmtp cannot deliver more than 300 mess/minute (very low I/O). This is enough for normal work but low under heavy load (distribution lists messages sometimes stay queued for 4 hours before deliver). We have arround 50000 boxes and use postfix as MTA How to increase lmtp performance? dovecot config for lda and lmtp: protocol lda { auth_socket_path = /usr/local/var/run/dovecot/auth-master info_log_path = /var/log/mail/dovecot_deliver.log log_path = /var/log/mail/dovecot_deliver.log mail_plugins = quota sieve zlib postmaster_address = postmaster(a)upm.es sendmail_path = /usr/lib/sendmail } protocol lmtp { info_log_path = /var/log/mail/dovecot_deliver.log log_path = /var/log/mail/dovecot_deliver.log mail_plugins = quota sieve zlib postmaster_address = postmaster(a)upm.es sendmail_path = /usr/lib/sendmail } In postfix I have: mailbox_transport = lmtp:unix:private/dovecot-lmtp Thanks in advance. -- ------------------------------------------------------ Juan Carlos Sanchez Hernandez Universidad Politecnica de Madrid ------------------------------------------------------

1 0

[Dovecot] Problems Configuring Pigeonhole/Seve
by Ian Barton 17 Oct '11

17 Oct '11

I am moving my email server from Ubuntu Lucid to Arch. The Arch server is running Dovecot V2.0.15. Email is working fine, but I can't get Pigeonhiole/sieve to work. My dovecot.conf is: protocols = imap sieve ssl = yes ssl_cert = </etc/ssl/certs/mail2.wilkesley.net.crt ssl_key = </etc/ssl/private/mail2.wilkesley.net.key first_valid_uid = 5000 first_valid_gid = 5000 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ namespace { location = maildir:/home/vmail/%d/%n/Maildir type = private prefix = INBOX. inbox = yes hidden = yes } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep } protocol lda { postmaster_address = ian(a)wilkesley.net hostname = wilkesley.org sendmail_path = /usr/sbin/sendmail mail_plugins = $mail_plugins sieve } protocol sieve { # Nothing to do here as defaults are OK } plugin { sieve = ~/.dovecot.sieve sieve_global_path = /home/vmail/globalsieverc sieve_dir = ~/ } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } I have created the sieve dir in the virtual users folder. However sieve doesn't appear to be working. I have tried logging in manually to see if sieve is running, but get the following error: ian:~/ $ gnutls-cli --starttls -p 143 mail2.wilkesley.net [8:32:22] Resolving 'mail2.wilkesley.net'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. According to the Dovecot wiki this should reply with the capabilities of my server, Note the server sends and receives mail OK using starttls. So what am I doing wrong?

2 1