- dovecot - dovecot.org

[Dovecot] Anyone using LG Voyager (vx10000) with dovecot IMAP?
by Adam McDougall 19 Aug '08

19 Aug '08

Anyone using the mobile IMAP option on the LG Voyager (mobile phone) with dovecot? I think it costs $5 extra per month. Seems low enough just to try it and find out. Thanks

1 0

[Dovecot] SpamAssassin and Maildir with Dovecot
by Kenneth Porter 19 Aug '08

19 Aug '08

A patch has been proposed for SpamAssassin to process Maildir folders of spam: <https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3003> Is this patch compatible with Dovecot's implementation of Maildir? For example, is anything needed to avoid stepping on Dovecot's metadata?

3 4

[Dovecot] POP3 dictionary attacks
by Kenneth Porter 18 Aug '08

18 Aug '08

I'm seeing strings of failed POP3 login attempts with obvious bogus usernames coming from different IP addresses. Today's originated from 216.31.146.19 (which resolves to neovisionlabs.com) This looks like a botnet attack. I got a similar probe a couple days ago. Is anyone else seeing these? The attack involves trying about 20 different names, about 3-4 seconds apart. Here's a few sample log lines: dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module Timo, can you add the port used in the attempt to the error log entry? (It does show up in the info log entry, but that means I need to correlate lines in the two log files.)

9 10

[Dovecot] IMAP maildir performance difference between dovecot-uidlist versions?
by Jack Stewart 17 Aug '08

17 Aug '08

Hi, Is there an IMAP performance difference using Maildir between using version 3 and version 1 of the dovecot-uidlist (either dovecot 1.0.7 or 1.1.2)? It isn't entirely clear to me there is any difference as the filename may contain the size/vsize information. The servers will eventually be running 1.1.2 with the maildir_copy_preserve_filename turned on. I'm doing a batch migration from courier to dovecot 1.0.7 and eventually dovecot 1.1.2. These servers are, and will continue to be, IMAP only (i.e. dedicated control/dovecot-uidlist files). The migration script is run once - no build on the fly. It does a readdir() to get the full filenames and make sure that list entries are only for existing files. As a result, there is almost complete freedom in the output format for the dovecot-uidlist. Many thanks in advance! ---Jack P.S. For better or worse, it does seem that once you are stuck with whatever initial version you choose. -- Jack Stewart IMSS, California Institute of Technology, M/C 1-10, 1200 E. California Blvd, Pasadena, CA 91125 jstewart(a)caltech.edu / 626-309-4690 http://www.imss.caltech.edu

2 1

Re: [Dovecot] POP3 dictionary attacks
by Bruce Bodger 16 Aug '08

16 Aug '08

On Aug 16, 2008, at 11:14 AM, Mark Sapiro wrote: >>> Exactly. These days, IP spoofing is most useful to hide the >>> identity of >>> the perpetrator of a DoS attack. It certainly is not applicable to a >>> dictionary attack on POP3 or other logins since with a spoofed >>> IP, the >>> perpetrator will never see the response to determine if the login >>> attempt was successful. >> >> I stand corrected... sorry. I was thinking of an http cross-site >> attack which also seems popular now-a-days. >> >> So if I read you right then you would consider the IP address shown >> in the original thread post.. >> >>> dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >> >> >> ..216.31.146.19, to be a party to the attack and therefore a >> candidate for locking out? > > > Yes. I do it (with my own script, not fail2ban, but it works the same > way). Thank you for the clarification. B. Bodger

1 0

[Dovecot] PAM session closes too soon
by Lauri Alanko 16 Aug '08

16 Aug '08

Hi. I'm trying to keep most of my data encrypted when possible, only keeping the decryption key in memory (and thus vulnerable to local attacks) when I'm actually using my data. In practice, this means using pam_mount to mount my home directory from an encrypted device. It almost looked like I could get this to work with mail as well, even when read via IMAP from a remote client: I placed my mail in the encrypted home directory, added pam_mount to /etc/pam.d/dovecot, and set session=yes in Dovecot's PAM configuration. Except that it didn't, quite: pam_mount worked just fine and mounted the encrypted disk using the IMAP password... and then immediately unmounted it, since for some reason session=yes means that Dovecot closes the session _immediately_ after opening it. This seems just silly. If a PAM session is to be used, then it seems obvious to me that its length should be exactly the length of the IMAP session. I can't see any reason for the current behavior, except maybe that it was a bit simpler to code and is sufficient for pam_mkhomedir (and only that). Can this be fixed with reasonable effort? Also, for pam_mount to work correctly, there must not be any file descriptors open in the mounted file system when the session closes, as otherwise unmounting is impossible. Will dovecot release all fds into the mail and index files when the session ends, or can it be made to do so? (UTSL is an acceptable answer.) Thanks in advance. Lauri Alanko la(a)iki.fi

2 1

[Dovecot] Error 89
by Hodges 16 Aug '08

16 Aug '08

Just installed dovecot 1.1.2. downloaded from dovecot.org. Seemed to compile and install OK but I get the following error when I try to start it "child 28410 (auth) returned error 89 (fatal failure)" I just want to use it for SMTP/SASL authorization, not Pop3 or IMAP, as yet It looks as though I haven't installed some component or other but what? Config file follows; # 1.1.2: /usr/local/etc/dovecot.conf protocols: none login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Steve

2 2

[Dovecot] Problem with squirrelmail and dovecot 1.1
by Gerhard Wiesinger 16 Aug '08

16 Aug '08

Hello! I'm running squirrelmail 1.4.8 (I know this is not the latest version) and know I'm having troubles with: 1.) Folder list view 2.) Save to sent or Drafts folder. Configuration worked well. I think it has to do with the upgrade from dovecot 1.0 to 1.1 and the LIST command. Thunderbird/alpine work well. Commands from rawlog are: A002 LIST "" "~/Mail/Drafts" A002 OK List completed. or A002 LIST "" "~/Mail/sent" A003 CREATE "~/Mail/sent" A002 OK List completed. A003 NO Mailbox exists. Has something changed in the folder behaviour of dovecot from 1.0 to 1.1? If you need more information please let me know it. Any ideas? Thnx. Ciao, Gerhard -- http://www.wiesinger.com/

1 0

Re: [Dovecot] SpamAssassin and Maildir with Dovecot
by Gabriel Millerd 15 Aug '08

15 Aug '08

On Fri, Aug 15, 2008 at 11:57 AM, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > A patch has been proposed for SpamAssassin to process Maildir folders of > spam: > Nothing on the disk looks modified by the code change, sa-learn is just reading from the disk fand altering the sa-storage as instructed by the learn rule switch. If you learned and then nuked some headers for example, the file size would change and that would be an issue if you storage that in the filename (they wouldn't match) as well as the dovecot index for imap/pop would be off potentially. Possibly some active imap sessions might be confused as well. This patch only really is sensitive to the Maildir structure, it has been able to handle the mail directories. -- Gabriel Millerd

1 0

[Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, this may be an obvious logical problem I'm not aware of, which cannot be solved any more efficiently... but maybe it's just a bug or there is potential for optimisation in Dovecot (or Thunderbird?). When searching for multiple terms at once ("any of") with Thunderbird/Dovecot (using FTS Squat indexes), it takes much longer (not double the time, or a bit more than that, but really much, much longer) than when I search for only one term. Here are some figures (the IMAP commands are shown as issued by Thunderbird and recorded by Dovecot rawlog). While searching, I can see the 'imap' process using 100% CPU time. Searching for "xyz" in Archive and subfolders 4 secs 32 select "Archive" 33 uid SEARCH UNDELETED BODY "xyz" 34 select "Archive.2004" 35 UID fetch 1:* (FLAGS) 36 uid SEARCH UNDELETED BODY "xyz" 37 select "Archive.2004.2005" 38 UID fetch 1:* (FLAGS) 39 uid SEARCH UNDELETED BODY "xyz" 40 select "Archive.2004.2005.2006" 41 UID fetch 1:* (FLAGS) 42 uid SEARCH UNDELETED BODY "xyz" 43 select "Archive.2004.2005.2006.2007" 44 UID fetch 1:* (FLAGS) 45 uid SEARCH UNDELETED BODY "xyz" 46 select "Archive.2004.2005.2006.2007.2008" 47 UID fetch 1:* (FLAGS) 48 uid SEARCH UNDELETED BODY "xyz" 49 IDLE Searching for "xyz" and "abc" (any of) in Archive and subfolders 123 secs 50 select "Archive" 51 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 52 select "Archive.2004" 53 UID fetch 1:* (FLAGS) 54 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 55 select "Archive.2004.2005" 56 UID fetch 1:* (FLAGS) 57 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 58 select "Archive.2004.2005.2006" 59 UID fetch 1:* (FLAGS) 60 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 61 select "Archive.2004.2005.2006.2007" 62 UID fetch 1:* (FLAGS) 63 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 64 select "Archive.2004.2005.2006.2007.2008" 65 UID fetch 1:* (FLAGS) 66 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 67 IDLE Searching for "xyz", "abc" and "def" in Archive and subfolders 173 secs 68 select "Archive" 69 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 70 select "Archive.2004" 71 UID fetch 1:* (FLAGS) 72 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 73 select "Archive.2004.2005" 74 UID fetch 1:* (FLAGS) 75 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 76 select "Archive.2004.2005.2006" 77 UID fetch 1:* (FLAGS) 78 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 79 select "INBOX" 80 UID fetch 1:* (FLAGS) 81 check 82 select "Archive.2004.2005.2006.2007" 83 UID fetch 1:* (FLAGS) 84 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 85 select "Archive.2004.2005.2006.2007.2008" 86 UID fetch 1:* (FLAGS) 87 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 88 IDLE Searching for "xyz", "abc", "def" and "ghi" in Archive and subfolders 217 secs 89 select "Archive" 90 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 91 select "Archive.2004" 92 UID fetch 1:* (FLAGS) 93 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 94 select "Archive.2004.2005" 95 UID fetch 1:* (FLAGS) 96 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 97 select "Archive.2004.2005.2006" 98 UID fetch 1:* (FLAGS) 99 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 100 select "Archive.2004.2005.2006.2007" 101 UID fetch 1:* (FLAGS) 102 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 103 select "Archive.2004.2005.2006.2007.2008" 104 UID fetch 1:* (FLAGS) 105 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 106 IDLE Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFIooxq7yMg/OiDoAURAhb9AJ4jOaK+eHXcSwJTAER8xEKIlJJt0gCgtZan wJm05V0F03gj+6YxbNOtCew= =jID/ -----END PGP SIGNATURE-----

5 5