- dovecot - dovecot.org

[Dovecot] POP3 dictionary attacks
by Kenneth Porter 18 Aug '08

18 Aug '08

I'm seeing strings of failed POP3 login attempts with obvious bogus usernames coming from different IP addresses. Today's originated from 216.31.146.19 (which resolves to neovisionlabs.com) This looks like a botnet attack. I got a similar probe a couple days ago. Is anyone else seeing these? The attack involves trying about 20 different names, about 3-4 seconds apart. Here's a few sample log lines: dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop,216.31.146.19): pam_authenticate() failed: User not known to the underlying authentication module Timo, can you add the port used in the attempt to the error log entry? (It does show up in the info log entry, but that means I need to correlate lines in the two log files.)

9 10

[Dovecot] IMAP maildir performance difference between dovecot-uidlist versions?
by Jack Stewart 17 Aug '08

17 Aug '08

Hi, Is there an IMAP performance difference using Maildir between using version 3 and version 1 of the dovecot-uidlist (either dovecot 1.0.7 or 1.1.2)? It isn't entirely clear to me there is any difference as the filename may contain the size/vsize information. The servers will eventually be running 1.1.2 with the maildir_copy_preserve_filename turned on. I'm doing a batch migration from courier to dovecot 1.0.7 and eventually dovecot 1.1.2. These servers are, and will continue to be, IMAP only (i.e. dedicated control/dovecot-uidlist files). The migration script is run once - no build on the fly. It does a readdir() to get the full filenames and make sure that list entries are only for existing files. As a result, there is almost complete freedom in the output format for the dovecot-uidlist. Many thanks in advance! ---Jack P.S. For better or worse, it does seem that once you are stuck with whatever initial version you choose. -- Jack Stewart IMSS, California Institute of Technology, M/C 1-10, 1200 E. California Blvd, Pasadena, CA 91125 jstewart(a)caltech.edu / 626-309-4690 http://www.imss.caltech.edu

2 1

Re: [Dovecot] POP3 dictionary attacks
by Bruce Bodger 16 Aug '08

16 Aug '08

On Aug 16, 2008, at 11:14 AM, Mark Sapiro wrote: >>> Exactly. These days, IP spoofing is most useful to hide the >>> identity of >>> the perpetrator of a DoS attack. It certainly is not applicable to a >>> dictionary attack on POP3 or other logins since with a spoofed >>> IP, the >>> perpetrator will never see the response to determine if the login >>> attempt was successful. >> >> I stand corrected... sorry. I was thinking of an http cross-site >> attack which also seems popular now-a-days. >> >> So if I read you right then you would consider the IP address shown >> in the original thread post.. >> >>> dovecot: Aug 15 04:15:45 Error: auth-worker(default): pam(mike, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:49 Error: auth-worker(default): pam(alan, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:53 Error: auth-worker(default): pam(info, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >>> dovecot: Aug 15 04:15:57 Error: auth-worker(default): pam(shop, >>> 216.31.146.19): pam_authenticate() failed: User not known to the >>> underlying authentication module >> >> >> ..216.31.146.19, to be a party to the attack and therefore a >> candidate for locking out? > > > Yes. I do it (with my own script, not fail2ban, but it works the same > way). Thank you for the clarification. B. Bodger

1 0

[Dovecot] PAM session closes too soon
by Lauri Alanko 16 Aug '08

16 Aug '08

Hi. I'm trying to keep most of my data encrypted when possible, only keeping the decryption key in memory (and thus vulnerable to local attacks) when I'm actually using my data. In practice, this means using pam_mount to mount my home directory from an encrypted device. It almost looked like I could get this to work with mail as well, even when read via IMAP from a remote client: I placed my mail in the encrypted home directory, added pam_mount to /etc/pam.d/dovecot, and set session=yes in Dovecot's PAM configuration. Except that it didn't, quite: pam_mount worked just fine and mounted the encrypted disk using the IMAP password... and then immediately unmounted it, since for some reason session=yes means that Dovecot closes the session _immediately_ after opening it. This seems just silly. If a PAM session is to be used, then it seems obvious to me that its length should be exactly the length of the IMAP session. I can't see any reason for the current behavior, except maybe that it was a bit simpler to code and is sufficient for pam_mkhomedir (and only that). Can this be fixed with reasonable effort? Also, for pam_mount to work correctly, there must not be any file descriptors open in the mounted file system when the session closes, as otherwise unmounting is impossible. Will dovecot release all fds into the mail and index files when the session ends, or can it be made to do so? (UTSL is an acceptable answer.) Thanks in advance. Lauri Alanko la(a)iki.fi

2 1

[Dovecot] Error 89
by Hodges 16 Aug '08

16 Aug '08

Just installed dovecot 1.1.2. downloaded from dovecot.org. Seemed to compile and install OK but I get the following error when I try to start it "child 28410 (auth) returned error 89 (fatal failure)" I just want to use it for SMTP/SASL authorization, not Pop3 or IMAP, as yet It looks as though I haven't installed some component or other but what? Config file follows; # 1.1.2: /usr/local/etc/dovecot.conf protocols: none login_dir: /usr/local/var/run/dovecot/login login_executable: /usr/local/libexec/dovecot/imap-login auth default: mechanisms: plain login passdb: driver: pam userdb: driver: passwd socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix Steve

2 2

[Dovecot] Problem with squirrelmail and dovecot 1.1
by Gerhard Wiesinger 16 Aug '08

16 Aug '08

Hello! I'm running squirrelmail 1.4.8 (I know this is not the latest version) and know I'm having troubles with: 1.) Folder list view 2.) Save to sent or Drafts folder. Configuration worked well. I think it has to do with the upgrade from dovecot 1.0 to 1.1 and the LIST command. Thunderbird/alpine work well. Commands from rawlog are: A002 LIST "" "~/Mail/Drafts" A002 OK List completed. or A002 LIST "" "~/Mail/sent" A003 CREATE "~/Mail/sent" A002 OK List completed. A003 NO Mailbox exists. Has something changed in the folder behaviour of dovecot from 1.0 to 1.1? If you need more information please let me know it. Any ideas? Thnx. Ciao, Gerhard -- http://www.wiesinger.com/

1 0

Re: [Dovecot] SpamAssassin and Maildir with Dovecot
by Gabriel Millerd 15 Aug '08

15 Aug '08

On Fri, Aug 15, 2008 at 11:57 AM, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > A patch has been proposed for SpamAssassin to process Maildir folders of > spam: > Nothing on the disk looks modified by the code change, sa-learn is just reading from the disk fand altering the sa-storage as instructed by the learn rule switch. If you learned and then nuked some headers for example, the file size would change and that would be an issue if you storage that in the filename (they wouldn't match) as well as the dovecot index for imap/pop would be off potentially. Possibly some active imap sessions might be confused as well. This patch only really is sensitive to the Maildir structure, it has been able to handle the mail directories. -- Gabriel Millerd

1 0

[Dovecot] Search for (any of) multiple terms slow
by Patrick Nagel 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, this may be an obvious logical problem I'm not aware of, which cannot be solved any more efficiently... but maybe it's just a bug or there is potential for optimisation in Dovecot (or Thunderbird?). When searching for multiple terms at once ("any of") with Thunderbird/Dovecot (using FTS Squat indexes), it takes much longer (not double the time, or a bit more than that, but really much, much longer) than when I search for only one term. Here are some figures (the IMAP commands are shown as issued by Thunderbird and recorded by Dovecot rawlog). While searching, I can see the 'imap' process using 100% CPU time. Searching for "xyz" in Archive and subfolders 4 secs 32 select "Archive" 33 uid SEARCH UNDELETED BODY "xyz" 34 select "Archive.2004" 35 UID fetch 1:* (FLAGS) 36 uid SEARCH UNDELETED BODY "xyz" 37 select "Archive.2004.2005" 38 UID fetch 1:* (FLAGS) 39 uid SEARCH UNDELETED BODY "xyz" 40 select "Archive.2004.2005.2006" 41 UID fetch 1:* (FLAGS) 42 uid SEARCH UNDELETED BODY "xyz" 43 select "Archive.2004.2005.2006.2007" 44 UID fetch 1:* (FLAGS) 45 uid SEARCH UNDELETED BODY "xyz" 46 select "Archive.2004.2005.2006.2007.2008" 47 UID fetch 1:* (FLAGS) 48 uid SEARCH UNDELETED BODY "xyz" 49 IDLE Searching for "xyz" and "abc" (any of) in Archive and subfolders 123 secs 50 select "Archive" 51 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 52 select "Archive.2004" 53 UID fetch 1:* (FLAGS) 54 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 55 select "Archive.2004.2005" 56 UID fetch 1:* (FLAGS) 57 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 58 select "Archive.2004.2005.2006" 59 UID fetch 1:* (FLAGS) 60 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 61 select "Archive.2004.2005.2006.2007" 62 UID fetch 1:* (FLAGS) 63 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 64 select "Archive.2004.2005.2006.2007.2008" 65 UID fetch 1:* (FLAGS) 66 uid SEARCH UNDELETED (OR BODY "xyz" BODY "abc") 67 IDLE Searching for "xyz", "abc" and "def" in Archive and subfolders 173 secs 68 select "Archive" 69 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 70 select "Archive.2004" 71 UID fetch 1:* (FLAGS) 72 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 73 select "Archive.2004.2005" 74 UID fetch 1:* (FLAGS) 75 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 76 select "Archive.2004.2005.2006" 77 UID fetch 1:* (FLAGS) 78 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 79 select "INBOX" 80 UID fetch 1:* (FLAGS) 81 check 82 select "Archive.2004.2005.2006.2007" 83 UID fetch 1:* (FLAGS) 84 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 85 select "Archive.2004.2005.2006.2007.2008" 86 UID fetch 1:* (FLAGS) 87 uid SEARCH UNDELETED (OR (OR BODY "xyz" BODY "abc") BODY "def") 88 IDLE Searching for "xyz", "abc", "def" and "ghi" in Archive and subfolders 217 secs 89 select "Archive" 90 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 91 select "Archive.2004" 92 UID fetch 1:* (FLAGS) 93 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 94 select "Archive.2004.2005" 95 UID fetch 1:* (FLAGS) 96 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 97 select "Archive.2004.2005.2006" 98 UID fetch 1:* (FLAGS) 99 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 100 select "Archive.2004.2005.2006.2007" 101 UID fetch 1:* (FLAGS) 102 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 103 select "Archive.2004.2005.2006.2007.2008" 104 UID fetch 1:* (FLAGS) 105 uid SEARCH UNDELETED (OR (OR (OR BODY "xyz" BODY "abc") BODY "def") BODY "ghi") 106 IDLE Patrick. - -- STAR Software (Shanghai) Co., Ltd. http://www.star-group.net/ Phone: +86 (21) 3462 7688 x 826 Fax: +86 (21) 3462 7779 PGP key: https://stshacom1.star-china.net/keys/patrick_nagel.asc Fingerprint: E09A D65E 855F B334 E5C3 5386 EF23 20FC E883 A005 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFIooxq7yMg/OiDoAURAhb9AJ4jOaK+eHXcSwJTAER8xEKIlJJt0gCgtZan wJm05V0F03gj+6YxbNOtCew= =jID/ -----END PGP SIGNATURE-----

5 5

[Dovecot] Migrating mbox to maildir
by Mike Hobbs 15 Aug '08

15 Aug '08

Sorry to bother everyone but I was wondering if it is possible for Dovecot to handle mbox AND maildir at the same time? Example: I want to convert from UW Imap using mbox to Dovecot using maildir. Do I need to convert ALL my users mbox mailboxes to maildir right away or can I convert them one at a time? I'd like to use maildir with all my new users, but I'd like to be able to continue using mbox for my old users and slowly convert them as I get time. Is this possible? I know Dovecot supports both formats, I just couldn't find anything in the install notes about using both at the same time. Thank you, mike

3 2

[Dovecot] Webmail app ... again.
by Roderick A. Anderson 15 Aug '08

15 Aug '08

There was a thread several weeks (or months) ago on webmail applications. I didn't like any of the options and only found few that I did but they were either expensive or not maintained. So ... I raised the question on the Catalyst Framework list about Perl based webmail apps and got nothing usable. It came down to what would it take to build a Perl (Cat) webmail app. Several others on the list got interested so we decided to build it. The main issue I run into is my lack of understanding of the ins-and-outs of the IMAP specification and the features that come with using Dovecot. (Oh yeah. Dovecot was the preferred IMAP server!) Another project I'm working on uses IMAP and what I found was there is a great quantity of Perl modules for dealing with IMAP. A great quantity! Unfortunately many of them assume a deeper knowledge of IMAP than I have so are very confusing. What I'm looking for is a good reference, besides the RFC, on IMAP. Anything out there? Electronic or dead-tree is fine. (A book of Dovecot would be neat too.) TIA, Rod --

10 17