- dovecot - dovecot.org

[Dovecot] Logging authentication failures?
by dri 19 Oct '06

19 Oct '06

I use a script that watches log files looking for failed ssh login attempts and adds firewall rules when there are enough login failures within a certain amount of time. I would like to apply this to Dovecot to automatically firewall attackers trying to brute-force an IMAP account. Is there a way to make Dovecot log authentication failures (I'm running 1.0.rc10)? In other words, can I configure Dovecot to put something in the log the instant "NO Authentication failed" is sent to the IMAP user? With "auth_verbose = yes" I can see individual authentication mechanisms fail, but I have multiple passdb sections so a failure in one mechanism doesn't mean a complete login failure. Thus, configuring the script to watch for individual mechanism failures may result in the firewalling of legitimate users. Thanks for any info!

1 0

[Dovecot] Proxy not working using passwd-file
by Clayton Epp 18 Oct '06

18 Oct '06

I've been having problems setting up my proxy using dovecot. I'm using the passwd-file for authentication as well as the regular unix passwd file. Can someone provide me with a complete example of how this should be done, I'm finding that the documentation on http://wiki.dovecot.org/AuthSpecials is sparse on the details. Please do not assume anything as I am new to both Dovecot as well as Linux (FC5).

1 0

[Dovecot] Dovecot-compatible web-based sieve configurator
by Koen Vermeer 18 Oct '06

18 Oct '06

Hi, I've set up dovecot with postfix and I'm using the dovecot LDA. It seems that sieve works, but I'm not that good at writing sieve scripts and I'd like to install something more user-friendly anyway. So: Does anyone know of a web-based sieve configurator that works with the dovecot implementation? I haven't been able to find one yet... Koen

3 4

[Dovecot] trash plugin causes crashes in quota plugin?
by Mike Horwath 18 Oct '06

18 Oct '06

I just lost my scrollback - so I'll have to recreate it the issue. Using both 1.0r7 and 1.0r10 on FreeBSD 6.1-STABLE. For the: mail_plugins = quota imap_quota that works fine (using maildir for quota plugin) But... mail_plugins = quota imap_quota trash will cause the quota plugin to die at line 156 of quota.c: root->v.deinit(root); I haven't dug through the code enough to find the actual area for this piece of code to add some debugging. Once I can generate a new traceback, I'll drop another email. -- Mike Horwath drechsau(a)iphouse.net ipHouse - Welcome home!

2 1

[Dovecot] passdb checkpassword and lastauth
by Max A 18 Oct '06

18 Oct '06

Hi. If checkpassword interface is used for working with vpopmail, function vpopmail "Record time and ip of last auth attempt" (--enable-auth-logging option for configure) won't work - the file "lastauth" is created in Maildir, but does not contain ip-address. If I had correctly understood, dovecot woldn't have set a enviroment variable TCPREMOTEIP for vchkpw. If changes are made in auth/passdb-checkpassword.c (a patch in attachment), everything will work. Probably, the patch is incorrect and does not solve all problems, however the request is to pay attention to existence of the problem. Also it is possible, that a similar problem exists with other variables TCP UCSPI protocol (http://cr.yp.to/proto/ucspi-tcp.txt) P.S. If use the interface vpopmail instead of checkpassword, the file "lastauth" will not be created at all, that is a little bit inconvenient. ********************************** System: dovecot-1.0.rc10 vpopmail-5.4.17 ASP Linux Server II (RHEL3 clone) kernel 2.4.21-47.EL.aspsmp CPU architecture: x86 (IBM xSeries 336) Filesystem: ext3 ********************************** dovecot configuration: base_dir = /var/run/dovecot/ protocols = imap pop3 disable_plaintext_auth = no ssl_disable = yes login_greeting = Ready. first_valid_uid = 89 last_valid_uid = 89 first_valid_gid = 89 last_valid_gid = 89 protocol imap { listen = 81.26.136.8:144 mail_executable = /usr/local/libexec/dovecot/imap mail_plugins = quota imap_quota mail_plugin_dir = /usr/local/lib/dovecot/imap imap_client_workarounds = delay-newmail outlook-idle netscape-eoh tb-extra-mailbox-sep } protocol pop3 { listen = 81.26.136.8:112 login_executable = /usr/local/libexec/dovecot/pop3-login mail_executable = /usr/local/libexec/dovecot/pop3 pop3_uidl_format = %f mail_plugins = quota mail_plugin_dir = /usr/local/lib/dovecot/pop3 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } auth default { mechanisms = plain login passdb checkpassword { args = /var/qmail/vpopmail/bin/vchkpw } userdb prefetch { } user = root } dict { } plugin { quota = maildir } *************************************** dovecot configure options: ./configure \ --disable-ipv6 \ --prefix=/usr/local \ --sysconfdir=/etc/dovecot \ --without-passwd \ --without-passwd-file \ --without-shadow \ --without-pam \ --without-bsdauth \ --with-checkpassword \ --with-vpopmail \ --without-static-userdb \ --with-prefetch-userdb \ --without-sql \ --without-pgsql \ --without-mysql \ --without-sqlite \ --with-ssl=openssl \ --with-pop3d \ --without-deliver \ --with-storages=maildir \ --with-docs ***************************************** vpopmail configure options: ./configure \ --enable-auth-module=cdb \ --enable-logging=p \ --enable-md5-passwords \ --enable-make-seekable \ --enable-file-sync \ --enable-ip-alias-domains \ --enable-clear-passwd \ --disable-roaming-users \ --disable-learn-passwords \ --disable-passwd \ --enable-auth-logging diff -ur dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c dovecot-1.0.rc10/src/auth/passdb-checkpassword.c --- dovecot-1.0.rc10.orig/src/auth/passdb-checkpassword.c 2006-08-22 06:37:56.000000000 +0400 +++ dovecot-1.0.rc10/src/auth/passdb-checkpassword.c 2006-10-17 16:47:09.000000000 +0400 @@ -226,6 +226,10 @@ env_put(t_strconcat("REMOTE_IP=", net_ip2addr(&request->remote_ip), NULL)); + env_put(t_strconcat("TCPREMOTEIP=", + net_ip2addr(&request->remote_ip), + NULL)); + } if (request->master_user != NULL) { env_put(t_strconcat("MASTER_USER=",

1 0

[Dovecot] 1.0.rc10 released
by Timo Sirainen 18 Oct '06

18 Oct '06

http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz http://dovecot.org/releases/dovecot-1.0.rc10.tar.gz.sig I've finally read all the mails in the mailing list and in my INBOX. If I haven't replied to some of your mail, please resend it. Remember that since 1.0.rc9 release dovecot.index.cache files will get rebuilt in 64bit systems, and it's probably better to delete them manually so you don't get errors in log files. There are only a couple of issues left in my v1.0-TODO list: - Master process appears to be leaking log fds with kqueue. Could someone again give me access to a system where this happens? - Login process problems. How well does it work now? Hopefully well enough that v1.0 could be released. - LDAP authentication is leaking memory? Can anyone confirm this? Even better, can someone figure out what exactly is leaking? :) Not a v1.0 blocker though. I think v1.0 will be released once no-one has reported any major problems for a Dovecot release in 2-4 weeks. I think login process handling is the only potentially major problem left. There are a few patches from people that I haven't forgotten, but I've decided not to put them into v1.0 anymore: - Filesystem quota group. I don't think it's that important feature, and it might break something. - HFS+ hardlink avoiding - Managesieve - vmailmgr support And finally the changes in this release: * When matching allowed_nets IPs, convert IPv6-mapped-IPv4 addresses to actual IPv4 addresses first. + IMAP: Try to avoid sending duplicate/useless message flag updates + Added support for non-plaintext authentication for vpopmail if it returns plaintext passwords. Based on patch by Remi Gacogne. + Added %D modified to return "sub.domain.org" as "sub,dc=domain,dc=org" (for LDAP queries). Patch by Andrey Panin. - rc9 broke cache files in 64bit systems - deliver works now with mail_chroot - auth cache didn't work properly with multiple passdbs - Fixes to handling CRLF linefeeds in mboxes.

13 22

[Dovecot] autoconf check for ldap not linking with -lber
by Jorgen Lundman 18 Oct '06

18 Oct '06

Maybe not a big deal, but generally you (used to?) link against both: configure:31276: checking for ldap_init in -lldap configure:31311: gcc -o conftest -std=gnu99 -I/usr/local/include -Wall -W -Wmiss ing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat =2 -Wbad-function-cast -I/usr/sfw/include -L/usr/local/lib conftest.c -lldap -lsocket -lnsl -lrt -lsendfile >&5 Undefined first referenced symbol in file ber_sockbuf_io_readahead /usr/local/lib/libldap.so ber_sockbuf_alloc /usr/local/lib/libldap.so ber_sockbuf_io_fd /usr/local/lib/libldap.so But could be special situation as my LDAP version is fixed, due to production environment using it. It also failed when OpenLDAP was linked against OpenSSL, since it does not try with the SSL libraries. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

2 3

[Dovecot] defunct processes
by LDB 18 Oct '06

18 Oct '06

I am using SuSE 10.1 and dovecot version 0.99.14-5. dovecot 6267 660 0 14:45 ? 00:00:00 imap-login dovecot 6285 660 0 14:45 ? 00:00:00 pop3-login dovecot 6371 660 0 14:45 ? 00:00:00 imap-login postfix 6454 12811 0 14:46 ? 00:00:00 smtp -t unix -u dovecot 6511 660 0 14:46 ? 00:00:00 pop3-login postfix 6550 12811 0 14:46 ? 00:00:00 showq -t unix -u dovecot 6576 660 0 14:46 ? 00:00:00 imap-login dovecot 6579 660 0 14:46 ? 00:00:00 pop3-login root 6580 666 1 14:46 ? 00:00:00 [dovecot-auth] <defunct> ldb 6581 660 0 14:46 ? 00:00:00 pop3 After dovecot has been up and running for a while (1 month or so), it tends to get hung up and unresponsive. I do a "ps" and I have a whole host of defunct processes. To restore service, I have to manually kill all dovecot processes and start it up again. Is this a symptom of my version or my configuration? Thanks, LDB

3 8

[Dovecot] Strange POP3 problem...
by Mike Cisar 18 Oct '06

18 Oct '06

I've been having this problem for a long time now. It started when I first began to use Dovecot (0.9x) and seems to have been occurring more and more frequently as we've progressed through the betas and now into RC7. I have been kind of chaulking it up to a "user issue" since the problem only seems to occur for one user (who has one machine at his office, and one at his weekend cabin... problem occurs with equal frequency on both of his machines). Lately it's been occurring about once every couple of days, but still nothing that I have been able to reproduce with any particular email or frequency. However as luck would have it the problem occurred today while I was onsite at the client's office so I was at least able to see that end of things at the same time. Essentially the user will have a number of messages in their mailbox (today for example 13) the download of mail will go just fine until one particular message and then the download will just stop, eventually returning an error message. Trying to receive mail again will retrieve messages 1-9 again and fail in the same spot. If you log in via IMAP and delete the following message (ie. the message after the one that was last received) you can then POP for mail again and the remaining messages in the mailbox will download. In the log all we see is the following (over and over)... Aug 28 16:14:51 mail dovecot: pop3-login: Login: user=<xxxxx>, method=PLAIN, rip=vvv.www.xxx.yyy, lip=vvv.www.xxx.yyy Aug 28 16:15:32 mail dovecot: POP3(xxxxx): Disconnected top=0/0, retr=9/170375, del=0/13, size=1349520 >From the client side I get the following in Outlook Express... "Your server has unexpectedly terminated the connection..." "...POP3, Server Response: '+OK 795 octets'..." Interestingly 795 bytes is the size of the "bad" email (the one that won't download). Any thoughts? Cheers, >>>>> Mike <<<<<

8 9

[Dovecot] Index files
by Steven F Siirila 17 Oct '06

17 Oct '06

I am doing some testing with Dovecot and wondered if it was normal for the deliver program to create index files for an Inbox (the test Inbox is over 7MB), but to not update the index files after the initial creation, even though messages continue to come into the mailbox. Note that during this testing, no IMAP or POP accesses are being made. Would it matter if a command-line program such as mutt were reading/updating the Inbox in question? Shouldn't Dovecot delivery be continually updating the index files as new messages arrive in the Inbox? -- Steven F. Siirila Office: Lind Hall, Room 130B Internet Services E-mail: sfs(a)umn.edu Office of Information Technology Voice: (612) 626-0244 University of Minnesota Fax: (612) 626-7593

2 4