- dovecot - dovecot.org

[Dovecot] Using checkpassword to block ips?
by Larry Ludwig 19 Jun '08

19 Jun '08

Hi new to the list, but we are a long time user of Dovecot via DirectAdmin control panel. We, like everyone else, are seeing an increase in dictionary attacks of POP/IMAP. We want to block them. I've searched the mailing list and found a few recommended fail2ban, which really won't work for our case. We need to do this over many machines and not one or two. We also like to gather info at the network wide level. Hackers know about attacking specific server/ips too often and we've seen much more distributed attacks that go under the radar of one server monitoring setup. We've designed our own system and use a local RBL to distribute the blocked IPs. For ftp and ssh attacks it's worked very well. We would like to use the RBL to do the same with dovecot. >From my research it appears the best way to do this (and only currently) is with the checkpassword option. I haven't gotten it to work yet. We have: passdb checkpassword { args = /usr/local/bin/checkpassword deny = yes } As the first auth.. This should reject the connection if the IP matches. checkpassword can see TCPREMOTEIP enviornmental variable. In the checkpassword script we have: #!/usr/bin/perl sub read_uinfo { my($user,$passwd,$apop_ts); open X,"<&=3" or exit 111; $_ = <X>; # ugly; should use sysread instead ($user,$passwd,$apop_ts) = /^(.*)\0(.*)\0(.*)\0/; while (<X>) {}; close X; return ($user,$passwd,$apop_ts); } ($user,$passwd,$apop_ts)=$debug?(shift,shift,shift):read_uinfo; $ipaddr=$ENV{TCPREMOTEIP}; $result=system("/usr/sbin/checkdnsbl $ipaddr"); if ( $result == 0) { @ENV{"SHELL","USER","HOME"} = ($shell,$user,$home); exit 0; } else { exit 1; } My questions are as follows: - Can the deny = yes be used with checkpassword? - What am I doing wrong with the script? It should reject only the connections that are in the RBL. It blocks all -L -- Larry Ludwig Empowering Media 1-866-792-0489 x600 Managed and Unmanaged Xen VPSes http://www.hostcube.com/

2 2

[Dovecot] quote-warning details
by Alexander Prinsier 19 Jun '08

19 Jun '08

Hello, I have some questions on how quota-warning is supposed to work. -Does it keep a state, so that it doesn't send the same warning several times? Or should the script itself do something to remember it already sent a warning? -When exactly does it run? Does it run when deliver runs? Or only when the user accesses it's mailbox? Thanks, Alexander

1 0

[Dovecot] dovecot as gmail imap proxy
by Farkas Levente 18 Jun '08

18 Jun '08

hi, may be this is a bit of topic, but i hope not. it's always a big question which is the better to choose a hosting provider to keep and manage you mail or setup your own mail server, hosting, virus and spam filter etc.. now as more and more people and company move to gmail or google apps mail service it seems google can't handle the load and it's getting more and more slower. what's more not just the imap interface but nowadays the web interface used to be hang or even stop working. it's getting more and more annoying that the speed is worst than in a 10 years ago. i thing about how can this be solved without totally give up gmail as a mail service provider (and may be they can solve it in a few months/years:-). would it be possible to create a dovecot server as an imap proxy for gmail and google apps? imho many people/company would be love to use such a setup where he can use gmail in vacation or any other time, but when the email is real critical apps (not acceptable to wait 1 minutes for an email to load or to open a folder/label) than he can use a proxy server eg. dovecot which act as a imap proxy to gmail and can be hosted on closer, faster server and this speed problem never happend. what's more it can be used as a mail backup server too. anybody has any such setup, idea? would it be possible with dovecot. any other suggestion? yours. -- Levente "Si vis pacem para bellum!"

6 14

Re: [Dovecot] Using checkpassword to block ips?
by Larry Ludwig 18 Jun '08

18 Jun '08

> ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 15 Jun 2008 19:04:05 -0400 > From: "Larry Ludwig" <larrylud(a)gmail.com> > Subject: [Dovecot] Using checkpassword to block ips? > To: <dovecot(a)dovecot.org> > Message-ID: <000601c8cf3c$1cd11130$0605a8c0@tank> > Content-Type: text/plain; charset="us-ascii" > > Hi new to the list, but we are a long time user of Dovecot > via DirectAdmin > control panel. > > We, like everyone else, are seeing an increase in dictionary > attacks of > POP/IMAP. We want to block them. > > I've searched the mailing list and found a few recommended > fail2ban, which > really won't work for our case. We need to do this over many > machines and > not one or two. We also like to gather info at the network > wide level. > Hackers know about attacking specific server/ips too often > and we've seen > much more distributed attacks that go under the radar of one server > monitoring setup. > > We've designed our own system and use a local RBL to > distribute the blocked > IPs. For ftp and ssh attacks it's worked very well. We > would like to use > the RBL to do the same with dovecot. > > >From my research it appears the best way to do this (and > only currently) is > with the checkpassword option. I haven't gotten it to work > yet. We have: > > passdb checkpassword { > args = /usr/local/bin/checkpassword > deny = yes > } > > As the first auth.. This should reject the connection if the > IP matches. > checkpassword can see TCPREMOTEIP enviornmental variable. > > In the checkpassword script we have: > > #!/usr/bin/perl > > sub read_uinfo { > my($user,$passwd,$apop_ts); > open X,"<&=3" or exit 111; > $_ = <X>; > # ugly; should use sysread instead > ($user,$passwd,$apop_ts) = /^(.*)\0(.*)\0(.*)\0/; > while (<X>) {}; > close X; > return ($user,$passwd,$apop_ts); > } > > ($user,$passwd,$apop_ts)=$debug?(shift,shift,shift):read_uinfo; > > $ipaddr=$ENV{TCPREMOTEIP}; > $result=system("/usr/sbin/checkdnsbl $ipaddr"); > if ( $result == 0) { > @ENV{"SHELL","USER","HOME"} = ($shell,$user,$home); > exit 0; > } > else { > exit 1; > } > > My questions are as follows: > - Can the deny = yes be used with checkpassword? > - What am I doing wrong with the script? It should reject only the > connections that are in the RBL. It blocks all > Bump.. No one can help with this setup or issue? -L -- Larry Ludwig Empowering Media 1-866-792-0489 x600 Managed and Unmanaged Xen VPSes http://www.hostcube.com/

1 0

[Dovecot] don't follow symlinks when creating mailbox list
by Dan Horák 18 Jun '08

18 Jun '08

Hi, this issue was discussed here twice in the not so far history (http://www.dovecot.org/list/dovecot/2008-January/028317.html, http://www.dovecot.org/list/dovecot/2008-February/029147.html) but I need to open it again as it makes problems for our users on one side and on the other side we don't want to diverge from the upstream sources in our packages. I agree with Timo that simply disabling the symlink following in creating the mailbox list can give a false sense of security so the question is whether a permanent solution can be developed and how it should look like? Regards, Dan -- Fedora and Red Hat package maintainer

3 3

[Dovecot] dovecot-uidlist cleanup
by Thomas Zajic 18 Jun '08

18 Jun '08

>From http://www.dovecot.org/list/dovecot/2008-June/031235.html: > > I have noticed that the entries in the dovecot-uidlist files don't seem > > to get updated when an email is deleted or moved to .Trash. It appears > > that this list list would just keep growing over time, being full of no > > longer used filenames, and must tend to increase its processing > > overhead. > > The deleted entries are removed when a new message arrives to the > mailbox. So it's just an optimization not to waste disk I/O on rewriting > the file when it's not necessary. If this isn't happening, there's > something wrong or you're misunderstanding something. >From http://www.dovecot.org/list/dovecot/2008-June/031403.html: > > However, I DO clobber the dovecot-uidlist in .Trash as part of my > > monthly housekeeping because it tends to get very large > > All the expunged messages get removed from it the next time a new > message is added to the mailbox. So there should be no need to delete > it. (v1.1 doesn't always recreate the file, but it gets rewritten if the > resulting file would be 70% of the current size or less.) If I understand this correctly, dovecot is supposed to clean out all deleted/expunged messages from dovecot-uidlist whenever a new message is added to the respective mailbox - right? This doesn't actually seem to be the case at least with dovecot-1.0: [root@airframe]:~# dovecot --version 1.0.14 [root@airframe]:~# [root@airframe]:~# du -h ~user/Maildir/.Trash/dovecot-uidlist 13M /home/user/Maildir/.Trash/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.Trash/dovecot-uidlist 289769 [root@airframe]:~# ls -1 ~user/Maildir/.Trash/cur/ | wc -l 14 [root@airframe]:~# [root@airframe]:~# du -h ~user/Maildir/.Logs.System\ Checks/dovecot-uidlist 3,5M /home/user/Maildir/.Logs.System Checks/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.Logs.System\ Checks/dovecot-uidlist 85188 [root@airframe]:~# ls -1 ~user/Maildir/.Logs.System\ Checks/cur/ | wc -l 16069 The only mailbox where this seems to work properly is INBOX: [root@airframe]:~# du -h ~user/Maildir/.INBOX/dovecot-uidlist 4,0K /home/user/Maildir/.INBOX/dovecot-uidlist [root@airframe]:~# wc -l < ~user/Maildir/.INBOX/dovecot-uidlist 18 [root@airframe]:~# ls -1 ~user/Maildir/.INBOX/cur/ | wc -l 17 [root@airframe]:~# The server runs sendmail, the LDA is procmail, not dovecot's deliver. The .procmailrc is empty except for the bare minimum, though, all other sorting is done either via Thunderbird message filters or manually: [root@airframe]:~# cat ~user/.procmailrc MAILDIR=$HOME/Maildir DEFAULT=.INBOX/ [root@airframe]:~# Any hints? Thanks, Thomas

3 5

[Dovecot] quota attribute for ldap.
by Mauro Sanna 18 Jun '08

18 Jun '08

I want to manage quotas and I want to manage quota limit with ldap. I use debian etch with slapd version 2.3 as ldap server. I see that in the schemas that comes with openLDAP debian distribution there are no quota attributes. How you have solved it?

1 0

[Dovecot] How to seperate pop3 and imap user lookup?
by Zhang Huangbin 18 Jun '08

18 Jun '08

Hi, all. I have two column in MySQL user table: - enablepop (NOT NULL default '1') - enableimap (NOT NULL default '1') How can i config dovecot to seperate pop user lookup and imap user lookup? Thanks very much. -- Best Regards. Zhang Huangbin - Mail Server Solution for Red Hat(R) Enterprise Linux & CentOS 5.x: http://rhms.googlecode.com/

2 3

[Dovecot] v1.1.rc10 released
by Timo Sirainen 18 Jun '08

18 Jun '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc10.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc10.tar.gz.sig v1.1.0 will be released on next Friday if nothing horrible happens. * LIST X-STATUS renamed to LIST STATUS and fixed its behavior with LIST-EXTENDED options. It's now compatible with STATUS-IN-LIST draft 00. - Message parsing could have sometimes produced incorrect results, corrupting BODY/BODYSTRUCTURE replies and perhaps others. - SORT: Fixed several bugs - FreeBSD 7.0: Environment clearing wasn't working correctly. This caused "environment corrupted" problems at least with deliver trying to call sendmail and running Dovecot from inetd. - HP-UX: Several fixes to get it to work (by Christian Corti) - Fixes to using expire plugin with SQL dictionary. - dbox fixes

6 5

[Dovecot] expire database
by Alfonso Sparano 17 Jun '08

17 Jun '08

Hi all I would like to know if there is function to force the load into the expire database of the old mails. I've enabled the function today (dovecot 1.1rc10) and I've a lot of old message that I think are not loaded automatically. What can I do? Thanks a Lot

2 1