- dovecot - dovecot.org

[Dovecot] Authentication Failure
by Carlos Mennens 11 Nov '10

11 Nov '10

I am unable to login to my new mail server running Dovecot and Postfix for some reason. When I check the mail logs, I am seeing: Nov 11 16:06:29 mail dovecot: imap-login: Disconnected (no auth attempts): rip=10.1.10.204, lip=192.168.0.200, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48 Nov 11 16:06:36 mail dovecot: auth: Error: pam(carlos,10.1.10.204): pam_authenticate() failed: Authentication failure (/etc/pam.d/dovecot missing?) Nov 11 16:06:53 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts): user=<carlos>, method=PLAIN, rip=10.1.10.204, lip=192.168.0.200, TLS Nov 11 16:07:12 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts): user=<carlos(a)iamghost.com>, method=PLAIN, rip=10.1.10.204, lip=192.168.0.200, TLS Below is my configuration file for Dovecot: # 2.0.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.35 x86_64 auth_mechanisms = plain login mail_location = maildir:~/mail passdb { driver = pam } protocols = imap service auth { unix_listener auth-client { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/mail.crt ssl_key = </etc/ssl/private/mail.key userdb { driver = passwd } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep } Does anyone know what is causing this error or how I can resolve this?

1 0

[Dovecot] $MAIL environment variable to override mail_location works in v1.2.16 but not in v2.0.7 for /usr/libexec/dovecot/imap
by Giam Teck Choon 11 Nov '10

11 Nov '10

Hi, For the past day, I have been researching about making dovecot to support mailfront (http://untroubled.org/mailfront/) imapfront-auth natively and able to use mailfront imapfront-auth with dovecot imap v1.2.16 without starting any dovecot related services and no /etc/dovecot.conf file is required. More information about this can be read at: http://lists.untroubled.org/?list=bgware&cmd=showthread&month=201011&thread… However, same trick can't be used for dovecot v2.0.7. First error is /etc/dovecot/dovecot.conf must be exists so I just simply touch /etc/dovecot/dovecot.conf with empty content to bypass that error. I noticed v2.0.7 is not using $MAIL environment variable to override mail_location? I have read the following: http://wiki2.dovecot.org/MailLocation Any idea to override mail_location setting? I have tried various setting of environment variables such as below: --------------------8<----------8<----------8<----------8<--------------------- #!/bin/sh # $MAIL, $HOME, $MAILDIR, $MAILBOX are the same in mailfront # imapfront-auth if [ -n "$MAIL" ]; then # make dovecot imap escape colon by replacing single : to :: export MAIL=maildir:`echo $MAIL | sed 's@:@::@g'` fi export USERDB_KEYS="$USERDB_KEYS mail" # For knowing all env. uncomment the below line and # see /tmp/imapd-log.txt # printenv >>/tmp/imapd-log.txt exec "$@" --------------------8<----------8<----------8<----------8<--------------------- The above script is being placed between imapfront-auth and dovecot imap (/usr/libexec/dovecot/imap). Thanks for any kind assistance. Kindest regards, Giam Teck Choon

2 5

[Dovecot] dovecot dictionary attacks
by PA 11 Nov '10

11 Nov '10

Hi, I been using dovecot for awhile and its been solid, however I been having some issues with dictionary attacks. I installed fail2ban and for the most part is working fine. However today I got another spammer relaying through my server. Looking at the logs I see the following dictonary attack from 94.242.206.37 Nov 10 03:04:38 pop dovecot: pop3-login: Disconnected: rip=94.242.206.37, lip=209.213.66.10 Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(ababa,94.242.206.37): lookup ..... And so on.. Then that ip gets banned by fail2ban [root@pop ~]# grep 94.242.206.37 /var/log/fail2ban.log 2010-11-10 03:04:42,416 fail2ban.actions: WARNING [dovecot] Ban 94.242.206.37 However on my smtp mail server that ip is already sending out all sorts of spam with the sasl username of Paramus. This username Paramus never shows up on the dovevot dictionary attack, as a matter of fact the user Paramus is nowhere to be found on the dovecot log at all and I have logs going back months. Does anyone have any idea what could of happened here. I mean if the user/passwd was already harvested by 94.242.206.37 why would they bother to start another dict. attack. I'm just not sure how they guess the username/password as its not on any logs that goes back months and I don't have a dovecot record for that user. /var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:48:00 mrelay3 postfix/smtpd[27785]: 87DE128016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:56:00 mrelay3 postfix/smtpd[27792]: 9728628015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:05:38 mrelay3 postfix/smtpd[27808]: D529F28015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:06:00 mrelay3 postfix/smtpd[27808]: DDF7C2801B: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=Paramus Any help would be appreciated. paul

2 3

[Dovecot] Sieve problem with managesieve
by Simone Caruso 11 Nov '10

11 Nov '10

I have a problem with a sieve script.. my config is dovecot 1.2.15 with managesieve, and roundcube. Now i have this script WORKING: -- require ["fileinto"]; # rule:[TracSvil] if anyof (header :contains "From" "xxx(a)example.com") { fileinto "INBOX.Trac Svil"; stop; } -- And this script NOT working: require ["fileinto"]; # rule:[TracSvil] if anyof (header :is "From" "trac(a)ardeek.com") { fileinto "INBOX.Trac Svil"; stop; } Can someone explain me the difference between these script? there is any error in the second script? Greetings! -- Simone Caruso IT Consultant p.iva: 03045250838

3 3

[Dovecot] dovecot dictionary attacks
by Paul Amaral 11 Nov '10

11 Nov '10

Hi, I been using dovecot for awhile and its been solid, however I been having some issues with dictionary attacks. I installed fail2ban and for the most part is working fine. However today I got another spammer relaying through my server. Looking at the logs I see the following dictonary attack from 94.242.206.37 Nov 10 03:04:38 pop dovecot: pop3-login: Disconnected: rip=94.242.206.37, lip=209.213.66.10 Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(ababa,94.242.206.37): lookup ..... And so on.. Then that ip gets banned by fail2ban [root@pop ~]# grep 94.242.206.37 /var/log/fail2ban.log 2010-11-10 03:04:42,416 fail2ban.actions: WARNING [dovecot] Ban 94.242.206.37 However on my smtp mail server that ip is already sending out all sorts of spam with the sasl username of Paramus. This username Paramus never shows up on the dovevot dictionary attack, as a matter of fact the user Paramus is nowhere to be found on the dovecot log at all and I have logs going back months. Does anyone have any idea what could of happened here. I mean if the user/passwd was already harvested by 94.242.206.37 why would they bother to start another dict. attack. I'm just not sure how they guess the username/password as its not on any logs that goes back months and I don't have a dovecot record for that user. /var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:48:00 mrelay3 postfix/smtpd[27785]: 87DE128016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:56:00 mrelay3 postfix/smtpd[27792]: 9728628015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:05:38 mrelay3 postfix/smtpd[27808]: D529F28015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:06:00 mrelay3 postfix/smtpd[27808]: DDF7C2801B: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=Paramus Any help would be appreciated. paul

1 0

[Dovecot] Getting the Sender from a Email
by Alex Baule 10 Nov '10

10 Nov '10

Hi Timo.... I need to get the Sender from a Email. Using this mail_get_first_header(mail, "From", &header) , i get the email in this format "Name <user@dom>" , in dovecot there is a way to get only the user@dom ? Tks !

2 1

[Dovecot] dovecot2.0+ldap auth problems
by Antonio Perez-Aranda 10 Nov '10

10 Nov '10

I'm using a config from dovecot 1.2 adapted to 2.0 After update config, and restart dovecot service: If I do a doveadm user user1 then it is found correctly. If I do a doveadm auth user1 then it is ask for the password user, and it's running correctly. But if I tray to login by telnet using IMAP then I get: . login user1 pass1 Connection closed by foreign host. I can see at logs a Info line with: Internal login failre with auth failed It's very odd that with doveadm runs ok and but not with IMAP.

1 1

[Dovecot] Help! LDAP/AD Problem with dovecot
by Christian Fischer 10 Nov '10

10 Nov '10

Hey Folks, i am trying to get Dovecot LDA to work with Active Directory dovecot --version 1.2.9 While using Postfix to deliver mail, dovecot does only imap-Services, passdb is auth bind and userdb is static. NOW i want to use Sieve Scripts. So LDA of dovecot is required. So userdb lookup is required. With use of virtual Mailboxes i have a working postfix setup, which needs to be transferred to dovecot. dovecot-ldap-userdb.conf uris = ldap://192.168.0.42 auth_bind = yes dn = myldapuser@mydomain dnpass = mypass #ldap_version = 3 base = DC=base,DC=com deref = never scope = subtree user_attrs = sAMAccountName=mail=maildir:/home/vmail/%$/.EMAIL, =uidNumer=5000, =gidNumber=5000 user_filter = (&(objectClass=user)(|(sAMAccountName=%u)(mail=%u)(othermailbox=%u))) pass_attrs = sAMAaccountName=user,userPassword=password pass_filter = (&(objectClass=person)(sAMAaccountName=%u)) My errors are: - While logging in with IMAP 2010-11-10 00:32:30 imap-login: Error: Timeout waiting for handshake from auth server. my pid=16293, input bytes=0 - manual execution of deliver -d myuser(a)domain.tld: 010-11-10 00:34:16 deliver(myuser(a)domain.tld): Error: userdb lookup(...): Connecting timed out As i said - postfix works! Thankx for any help!

2 1

[Dovecot] Problem with dovecot delivery (version 2.0.7)
by Maxime Longuepee 10 Nov '10

10 Nov '10

Hi! I've been having an issue with dovecot since yesterday and can't figure it out. All my users can send mail without any problem but all incomming mail are deffered. Here is the log from postfix complaining the mail has been deferred: Nov 9 23:35:51 www postfix/pipe[50019]: A20EB145FC2C: to=, relay=dovecot, delay=819, delays=819/0.01/0/0.01, dsn=4.3.0, status=deferred (temporary failure) And here is the log from dovecot complaining it can't complete the operation /var/log/dovecot-deliver.log: Nov 09 23:35:51 lda(EMAIL REMOVED FOR PRIVACY): Fatal: setresgid(6(mail),6(mail),6(mail)) failed with euid=143(dovecot): Operation not permitted If anyone could help me, it would be much appreciated! Thanks!

4 10

[Dovecot] need to block user by IP address (tried denyhosts, xinetd, iptables etc)
by Tom 10 Nov '10

10 Nov '10

Hi, I am kind of restricted to using packaged versions of software due to company policy, and we have f12 on our mail server with dovecot-1.2.15-2.fc12.i686 package. we have recently had some brute force attacks on the pop3 and imapd and this results in many processes being used for login attempts. Our dovecot is hosted on a Virtual Private Server which restricts access to IPTABLEs and also make a limit on the number of processes that can be running So I can't restrict the attackers IP addresses via IPTABLES, as we don't have access to that. I can't really patch dovecot as we are reliant on the distro packages. I spent some time trying to get dovecot to run under xinetd but had no luck, and I read some reports that it was not possible using recent versions. I was hoping some advice on what avenue I should proceed with to automatically block brute force attacks on the dovecot server, (that dont use iptables) Thanks, Tom

5 5