- dovecot - dovecot.org

[Dovecot] Re : Permission denied
by Frédéric Sapin 09 Jul '04

09 Jul '04

Hello Timo, I'm using linux Fedora Core 2. The permissions are : drwxrwxrwt 2 root mail 32 2004-06-16 04:45 /var/spool/mail/ These permissions are made buy the command chmod a+rwxt /var/spool/mail. So if someone wants to erase the /var/spool/mail directory, it's possible unfortunately. If there are theses permissions the user can receive his mails but it's dangerous I think. And if I modify the dovecot.conf file : mail_extra_groups = mail and if the permissions are the initial permission, and if I enter chmod +t /var/spool/mail the user can't receive his mail. Thanks Frederic

4 6

[Dovecot] bug in openssl proxy code (1.0-test24) ?
by Andrey Panin 09 Jul '04

09 Jul '04

Hi all, If client connects to pop3 server, issues STLS command and then drops connection dovecot starts flooding syslog with this message repeated endlessly: Jul 9 14:31:40 smtp dovecot: pop3-login: SSL_accept() syscall failed: EOF [80.254.111.9] Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

2 3

[Dovecot] passing remote ip to pam
by dean gaudet 09 Jul '04

09 Jul '04

to improve forensic log info i want to set the PAM_RHOST value to the remote ip (which pam logs as rhost=foo in failure messages). i didn't look to see if anything has been done in this way on CVS because i'm still on 0.99.10.6. below is a bit of a hack. in some sense the remote_ip might make more sense in the AUTH_LOGIN_REQUEST_NEW packet rather than the continue packet... but that looked like i'd have to change more code :) btw -- is there anything which stops mech_plain_auth_continue from doing a somewhat unbounded pstrdup if you send "a\0b" for the auth string? -dean diff -rpu dovecot-0.99.10.6.deborig/debian/changelog dovecot-0.99.10.6/debian/changelog --- dovecot-0.99.10.6.deborig/debian/changelog 2004-07-08 18:11:55.000000000 -0700 +++ dovecot-0.99.10.6/debian/changelog 2004-07-08 18:34:40.000000000 -0700 @@ -1,3 +1,9 @@ +dovecot (0.99.10.6-3.dg1) unstable; urgency=low + + * hack a solution to pass PAM_RHOST the remote ip + + -- dean gaudet <dean(a)arctic.org> Thu, 8 Jul 2004 18:34:26 -0700 + dovecot (0.99.10.6-3) unstable; urgency=low * Patched so dovecot follows symlinks to directories again. diff -rpu dovecot-0.99.10.6.deborig/src/auth/auth-login-interface.h dovecot-0.99.10.6/src/auth/auth-login-interface.h --- dovecot-0.99.10.6.deborig/src/auth/auth-login-interface.h 2003-05-18 05:26:28.000000000 -0700 +++ dovecot-0.99.10.6/src/auth/auth-login-interface.h 2004-07-08 18:32:22.000000000 -0700 @@ -1,6 +1,8 @@ #ifndef __AUTH_LOGIN_INTERFACE_H #define __AUTH_LOGIN_INTERFACE_H +#include "network.h" + /* max. size for auth_login_request_continue.data[] */ #define AUTH_LOGIN_MAX_REQUEST_DATA_SIZE 4096 @@ -57,6 +59,8 @@ struct auth_login_request_continue { enum auth_login_request_type type; /* AUTH_LOGIN_REQUEST_CONTINUE */ unsigned int id; + struct ip_addr remote_ip; + size_t data_size; /* unsigned char data[]; */ }; diff -rpu dovecot-0.99.10.6.deborig/src/auth/mech-plain.c dovecot-0.99.10.6/src/auth/mech-plain.c --- dovecot-0.99.10.6.deborig/src/auth/mech-plain.c 2003-05-18 05:26:28.000000000 -0700 +++ dovecot-0.99.10.6/src/auth/mech-plain.c 2004-07-08 18:25:14.000000000 -0700 @@ -21,6 +21,7 @@ mech_plain_auth_continue(struct auth_req size_t i, count, len; auth_request->callback = callback; + auth_request->remote_ip = request->remote_ip; /* authorization ID \0 authentication ID \0 pass. we'll ignore authorization ID for now. */ diff -rpu dovecot-0.99.10.6.deborig/src/auth/mech.h dovecot-0.99.10.6/src/auth/mech.h --- dovecot-0.99.10.6.deborig/src/auth/mech.h 2003-05-18 05:26:28.000000000 -0700 +++ dovecot-0.99.10.6/src/auth/mech.h 2004-07-08 18:31:42.000000000 -0700 @@ -1,6 +1,7 @@ #ifndef __MECH_H #define __MECH_H +#include "network.h" #include "auth-login-interface.h" struct login_connection; @@ -11,6 +12,7 @@ typedef void mech_callback_t(struct auth struct auth_request { pool_t pool; char *user; + struct ip_addr remote_ip; struct login_connection *conn; unsigned int id; diff -rpu dovecot-0.99.10.6.deborig/src/auth/passdb-pam.c dovecot-0.99.10.6/src/auth/passdb-pam.c --- dovecot-0.99.10.6.deborig/src/auth/passdb-pam.c 2003-11-08 06:17:51.000000000 -0800 +++ dovecot-0.99.10.6/src/auth/passdb-pam.c 2004-07-08 18:32:52.000000000 -0700 @@ -166,13 +166,23 @@ static int pam_userpass_conv(int num_msg return PAM_SUCCESS; } -static int pam_auth(pam_handle_t *pamh, const char *user, const char **error) +static int pam_auth(pam_handle_t *pamh, const char *user, + const struct ip_addr *remote_ip, const char **error) { void *item; int status; + const char *addr; *error = NULL; + if ((addr = net_ip2addr(remote_ip)) + && (status = pam_set_item(pamh, PAM_RHOST, addr)) + != PAM_SUCCESS) { + *error = t_strdup_printf("pam_set_item(PAM_RHOST, %s) failed: %s", + addr, pam_strerror(pamh, status)); + return status; + } + if ((status = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { *error = t_strdup_printf("pam_authenticate(%s) failed: %s", user, pam_strerror(pamh, status)); @@ -205,7 +215,8 @@ static int pam_auth(pam_handle_t *pamh, static void pam_verify_plain_child(const char *service, const char *user, - const char *password, int fd) + const char *password, const struct ip_addr *remote_ip, + int fd) { pam_handle_t *pamh; struct pam_userpass userpass; @@ -228,7 +239,7 @@ pam_verify_plain_child(const char *servi str = t_strdup_printf("pam_start(%s) failed: %s", user, pam_strerror(pamh, status)); } else { - status = pam_auth(pamh, user, &str); + status = pam_auth(pamh, user, remote_ip, &str); if ((status2 = pam_end(pamh, status)) == PAM_SUCCESS) { /* FIXME: check for PASSDB_RESULT_UNKNOWN_USER somehow? */ @@ -353,7 +364,7 @@ pam_verify_plain(struct auth_request *re if (pid == 0) { (void)close(fd[0]); - pam_verify_plain_child(service, request->user, password, fd[1]); + pam_verify_plain_child(service, request->user, password, &request->remote_ip, fd[1]); _exit(0); } diff -rpu dovecot-0.99.10.6.deborig/src/imap-login/client-authenticate.c dovecot-0.99.10.6/src/imap-login/client-authenticate.c --- dovecot-0.99.10.6.deborig/src/imap-login/client-authenticate.c 2003-11-24 11:50:55.000000000 -0800 +++ dovecot-0.99.10.6/src/imap-login/client-authenticate.c 2004-07-08 18:21:19.000000000 -0700 @@ -140,7 +140,7 @@ static void login_callback(struct auth_r case 0: /* continue */ ptr = buffer_get_data(client->plain_login, &size); - auth_continue_request(request, ptr, size); + auth_continue_request(request, ptr, size, &client->common.ip); buffer_set_used_size(client->plain_login, 0); break; @@ -270,7 +270,8 @@ static void client_auth_input(void *cont } else { auth_continue_request(client->common.auth_request, buffer_get_data(buf, NULL), - buffer_get_used_size(buf)); + buffer_get_used_size(buf), + &client->common.ip); } /* clear sensitive data */ diff -rpu dovecot-0.99.10.6.deborig/src/login-common/auth-connection.c dovecot-0.99.10.6/src/login-common/auth-connection.c --- dovecot-0.99.10.6.deborig/src/login-common/auth-connection.c 2003-05-26 08:27:13.000000000 -0700 +++ dovecot-0.99.10.6/src/login-common/auth-connection.c 2004-07-08 18:33:38.000000000 -0700 @@ -335,13 +335,21 @@ int auth_init_request(enum auth_mech mec } void auth_continue_request(struct auth_request *request, - const unsigned char *data, size_t data_size) + const unsigned char *data, size_t data_size, + const struct ip_addr *remote_ip) { struct auth_login_request_continue auth_request; /* send continued request to auth */ auth_request.type = AUTH_LOGIN_REQUEST_CONTINUE; auth_request.id = request->id; + if (remote_ip) { + auth_request.remote_ip = *remote_ip; + } + else { + memset(&auth_request.remote_ip, + 0, sizeof(auth_request.remote_ip)); + } auth_request.data_size = data_size; if (o_stream_send(request->conn->output, &auth_request, diff -rpu dovecot-0.99.10.6.deborig/src/login-common/auth-connection.h dovecot-0.99.10.6/src/login-common/auth-connection.h --- dovecot-0.99.10.6.deborig/src/login-common/auth-connection.h 2003-02-09 23:56:23.000000000 -0800 +++ dovecot-0.99.10.6/src/login-common/auth-connection.h 2004-07-08 18:20:58.000000000 -0700 @@ -48,7 +48,8 @@ int auth_init_request(enum auth_mech mec const char **error); void auth_continue_request(struct auth_request *request, - const unsigned char *data, size_t data_size); + const unsigned char *data, size_t data_size, + const struct ip_addr *remote_ip); void auth_abort_request(struct auth_request *request); diff -rpu dovecot-0.99.10.6.deborig/src/pop3-login/client-authenticate.c dovecot-0.99.10.6/src/pop3-login/client-authenticate.c --- dovecot-0.99.10.6.deborig/src/pop3-login/client-authenticate.c 2003-11-24 11:52:09.000000000 -0800 +++ dovecot-0.99.10.6/src/pop3-login/client-authenticate.c 2004-07-08 18:21:32.000000000 -0700 @@ -141,7 +141,7 @@ static void login_callback(struct auth_r case 0: ptr = buffer_get_data(client->plain_login, &size); - auth_continue_request(request, ptr, size); + auth_continue_request(request, ptr, size, &client->common.ip); buffer_set_used_size(client->plain_login, 0); break; @@ -259,7 +259,8 @@ static void client_auth_input(void *cont } else { auth_continue_request(client->common.auth_request, buffer_get_data(buf, NULL), - buffer_get_used_size(buf)); + buffer_get_used_size(buf), + &client->common.ip); } /* clear sensitive data */

2 1

[Dovecot] Permission denied
by Frédéric Sapin 09 Jul '04

09 Jul '04

Hello all, I'm a new user of dovecot and I've got a permission denied problem. I've read the VarMailDotLock wiki paper but there is still a security problem. If I enter : chmod a+rwxt /var/spool/mail it works but I think it's very dangerous to have thaht rights. So I've tried to edit the dovecot.conf file and to change the mail_extra_groups = mail and to change the rights : chmod +t /var/spool/mail but it doesn't work ! The mails are in /var/spool/mail/unix_user_name Could you please help me to configure the /var/spool/mail to have a good security and to allow people to receive their mails ? Thanks Frederic

2 1

[Dovecot] a yum install with mysql support??
by alex＠alution.com 09 Jul '04

09 Jul '04

Hello, Well im guessing i have already answered this question myself. Im using FC1 and installed dovecot the easy way (yum install dovecot) It has stated that it installed version 0.99.10.5 and from what I have looked at in the mailing list archives, this version SHOULD have mysql authentication support. However what I don´t know is if by installing the yum package it will allow this support. Im guessing that I will have to install it the real way, as if I take a look in the logs, it states... ============== dovecot-auth: "Jul 09 00:37:38 "Fatal: Unknown userdb type 'mysql' dovecot: "Jul 09 00:37:38 "Error: Auth process died too early - shutting down dovecot: "Jul 09 00:37:38 "Error: child 31532 (auth) returned error 89 ============== Am i correct in thinking this? Or is there something else a miss?? Thanks Alex

1 0

Re: [Dovecot] 1.0-test26
by Matthew Reimer 09 Jul '04

09 Jul '04

Timo Sirainen wrote: > On 9.7.2004, at 00:57, Mark E. Mallett wrote: > >> On Fri, Jul 09, 2004 at 12:34:04AM +0300, Timo Sirainen wrote: >> >>> http://dovecot.org/test/ >>> >>> - Fixed APPEND hanging if the whole message was sent in one TCP packet >>> (ie. fixes the "Sent mail" hangs) >> >> >> Curious-- how does the application-level code care about TCP packets? > > > It reads all of it into buffer, then later tries to read more even > though everything was already in that buffer so it gets stuck at > waiting. Dovecot's istream-limit wrapper stream specifically was a > problem. It called parent stream's read() function without checking > first if there was already data in it's buffer. > > These wrapper streams have been quite difficult in general. mbox support > is implemented using one of those too and it took quite a while to get > it working correctly. I guess I should write some comments there how > exactly they should be implemented. Is this a problem in 0.99 as well? Matt

2 1

[Dovecot] 1.0-test26
by Timo Sirainen 09 Jul '04

09 Jul '04

http://dovecot.org/test/ - Fixed APPEND hanging if the whole message was sent in one TCP packet (ie. fixes the "Sent mail" hangs) - Some changes in MySQL defaults - Working APOP auth - Fixes/improvements for cache file code. Still isn't as smart as it could, but it seems to work again. The code is nearing a state where plugins could add their own data into cache file.

2 3

Re: [Dovecot] Logging "issue" with PAM authentication
by Steve Johnson 07 Jul '04

07 Jul '04

Great, thanks a lot, solved the problem. No more annoying logs every 2-5 seconds :) Steve Johnson On Wed, 2004-07-07 at 14:39, Ray Miller wrote: > On Wed, Jul 07, 2004 at 02:21:04PM -0400, Steve Johnson wrote: > > > > I've tried with just the following: > > > > auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass > > password sufficient /lib/security/$ISA/pam_ldap.so use_authtok > > session optional /lib/security/$ISA/pam_ldap.so > > [...] > > In both of these situations, users can't authenticate. Is there > > something I'm doing wrong? I'm not that familiar with pam, so it's a > > very plausible cause! :) > > I'm fairly sure you don't need the password line, but that's not > likely to be causing your problem - more likely it's the use_first_pass > option. Try: > > auth required /lib/security/$ISA/pam_ldap.so > account required /lib/security/$ISA/pam_ldap.so > password required /lib/security/$ISA/pam_deny.so > session required /lib/security/$ISA/pam_ldap.so

1 0

[Dovecot] Peer Config Review
by Eric Kahklen 07 Jul '04

07 Jul '04

I am trying to setup a mail server using Postfix and Squirrelmail. The mail server will ONLY use webmail for access. I will not be using any email clients other than Squirrelmail. I've got the server working in a testing environment. Could people who are dovecot savy look over the config I have set? I've only included the directives that are enabled with no comments. I want a simple but secure backup mail server for about 75 users. Thank you, Eric base_dir = /var/run/dovecot/ protocols = imap login_dir = /var/run/dovecot/login login = imap login_executable = /usr/libexec/dovecot/imap-login mbox_locks = fcntl imap_executable = /usr/libexec/dovecot/imap imap_modules = /usr/lib/dovecot/imap auth = default auth_mechanisms = plain auth_userdb = passwd auth_passdb = pam auth_executable = /usr/libexec/dovecot/dovecot-auth auth_user = root --

1 0

[Dovecot] Logging "issue" with PAM authentication
by Steve Johnson 07 Jul '04

07 Jul '04

Hi, We currently have a postfix/dovecot setup using nss_ldap with PAM for authentication. Everything is working fine, but there are excessive "error" messages in /var/log/messages that I'd like to prevent from happening. Since auth_userdb defaults to passwd and that our users are not in the passwd file, we get the following message everytime a user logs in: Jul 7 13:34:37 hostname dovecot(pam_unix)[32206]: check pass; user unknown Jul 7 13:34:37 hostname dovecot(pam_unix)[32206]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= We of course also get the input that a user has logged in, in /var/log/maillog: imap-login: Jul 07 13:34:37 Info: Login: username [xxx.xxx.xxx.xxx] I've tried changing auth_verbose to no, and I still get those messages. Is there any way to prevent this from happening? Thanks a lot, Steve Johnson

2 2