- dovecot - dovecot.org

Dovecot send duplicated certificates when using ssl_alt_cert
by Jean-Daniel Dupas 24 May '18

24 May '18

Hello, I'm running dovecot 2.3.1 (c5a5c0c82) and trying to experiment with using both RSA and ECDSA certificates. My configuration is as follow: ssl_alt_cert = </path/to/my.rsa.key ssl_alt_key = </path/to/my.rsa.key ssl_cert = </path/to/my.ecdsa.pem ssl_key = </path/to/my.ecdsa.key Both certificates are let's encrypt certificate, so both are using the same intermediate CA. The certificate chain are: for rsa: - my certificate - Let's Encrypt Authority X3 - DST Root CA X3 for ecdsa: - my certificate - Let's Encrypt Authority X3 - DST Root CA X3 My problem is that when connecting, dovecot includes 2 copies of Let's Encrypt Authority X3 in the certificate chain. I think this is a bug. When building the chain, dovecot should ignore duplicated certificates and when opening the connection, it should only send intermediates related to the used certificate (either RSA or ECDSA). (and as a side note, when using dovecot -n, dovecot hides the ssl_key (ssl_key = # hidden, use -P to show it) but not the ssl_alt_key. This is probably a bug too). --------------- openssl s_client -showcerts -host imap.example.com -port 993 -servername imap.example.com CONNECTED(00000005) depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify error:num=20:unable to get local issuer certificate verify return:0 --- Certificate chain 0 s:/CN=imap.example.com i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 -----BEGIN CERTIFICATE----- MIIHPDCCBiSgAwIBAgISA2e3bP2o1mpdOr9kTDm/R/zuMA0GCSqGSIb3DQEBCwUA … -----END CERTIFICATE----- 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT … -----END CERTIFICATE----- 2 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT … -----END CERTIFICATE----- --- Server certificate subject=/CN=imap.example.com issuer=/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 --- No client certificate CA names sent --- SSL handshake has read 5140 bytes and written 468 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: 591240C021A02B399CCB010F37AF7AD83227DC1770C606F73B3EEA3514AF07FB Session-ID-ctx: Master-Key: 7D5A5BFC1B4B8EECF4F41DC084265AF6D32B82130F381B8DDF685B589D54D9BDEBFC20F1DD80E150CD56850C0D062E9E TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 3a 72 98 05 72 af 3d ed-26 a9 e7 2b 68 6b 0a 25 :r..r.=.&..+hk.% … Start Time: 1526482021 Timeout : 300 (sec) Verify return code: 0 (ok) ---

3 3

Re: lazy_expuge + mdbox
by Matt Bryant 24 May '18

24 May '18

To a degree I agree .. given mdbox doesnt delete until purge .. but then would be nice if purge took a dovecot search rather than just ditch everything with refcount=0 ... in that way could say purge everything thats been marked as delete according to a specified criteria. rgds Matt completly unrelated moved mailserver back home and listed on cyren so atm getting bounced by dovecot.fi .. have requested de-listing > Aki Tuomi <mailto:aki.tuomi@dovecot.fi> > 24 May 2018 at 3:35 pm > > I am not sure if lazy expunge makes much sense with mdbox, at least if > you use the same mdbox storage with it. It might make sense with > separate mdbox/sdbox/something for .EXPUNGED. > > Aki > Matt Bryant <mailto:matt@the-bryants.net> > 24 May 2018 at 11:53 am > So moving on from earlier issue now looking at converting mail inbox to > mdbox and keeping lazy_expunge as mdbox also .. but again seeing some > wierdness so questions .... > > 1) When i purge trash folder I seem to get 2 copies of the message in > .EXPUNGED/Trash folder .. however if I set > lazy_expunge_only_last_instance = yes then dont seem to get ANY copy .. > just nothing. > > 2) If I go into Trash and delete a message ... then it does not get > moved .. I assume that a delete in Trash is not actually an expunge on > TB and hence does get caught by the plugin. > > 3) Since mdbox doesnt delte anything anyway until purged would it be > better not to use lazy-expunge but just have a job that moves any > messages in mdbox_deleted: storage to the hidden .EXPUNGED namespace .. > does doveadm move work with mdbox_deleted ??? > > any help appreciated > > rgds > > Matt

2 1

lazy_expuge + mdbox
by Matt Bryant 24 May '18

24 May '18

So moving on from earlier issue now looking at converting mail inbox to mdbox and keeping lazy_expunge as mdbox also .. but again seeing some wierdness so questions .... 1) When i purge trash folder I seem to get 2 copies of the message in .EXPUNGED/Trash folder .. however if I set lazy_expunge_only_last_instance = yes then dont seem to get ANY copy .. just nothing. 2) If I go into Trash and delete a message ... then it does not get moved .. I assume that a delete in Trash is not actually an expunge on TB and hence does get caught by the plugin. 3) Since mdbox doesnt delte anything anyway until purged would it be better not to use lazy-expunge but just have a job that moves any messages in mdbox_deleted: storage to the hidden .EXPUNGED namespace .. does doveadm move work with mdbox_deleted ??? any help appreciated rgds Matt

1 0

Released Pigeonhole v0.4.24 for Dovecot v2.2.36.
by Stephan Bosch 24 May '18

24 May '18

Hello Dovecot users, Here is the Pigeonhole release that goes with the new Dovecot v2.2.36 release. Apart from the changes that were already in the RC, this final release adds one new feature: a plugin for the IMAP FILTER=SIEVE capability. The is a vendor-defined feature that adds the ability to manually invoke Sieve filtering in IMAP. Changelog v0.4.24: + Implement plugin for the a vendor-defined IMAP capability called "FILTER=SIEVE". It adds the ability to manually invoke Sieve filtering in IMAP. More information can be found in doc/plugins/imap_filter_sieve.txt. - Fix assert panics triggered by empty messages that are being forwarded using redirect or vnd.dovecot.report. This does not likely normally occur, but this is seen as a result of certain benign failures in object storage. - Make the length of the subject header for the vacation response configurable and enforce the limit in UTF-8 codepoints rather than bytes. The subject header for a vacation response was statically truncated to 256 bytes, which is too limited for multi-byte UTF-8 characters. - Sieve editheader extension: Fix assertion panic occurring when it is used to manipulate a message header with a very large header field. - Properly abort execution of the sieve_discard script upon error. Before, the LDA Sieve plugin attempted to execute the sieve_discard script when an error occurs. This can lead to the message being lost. - Fix the interaction between quota and the sieve_discard script. When quota was used together with a sieve_discard script, the message delivery did not bounce when the quota was exceeded. The release is available as follows: https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.t… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Autofile Junk for all users
by ＠lbutlr 23 May '18

23 May '18

How would I get the rule if header :contains "X-spam-flag" "YES" { fileinto "Junk"; } To apply to all users mail at delivery time?

4 4

Creating users on the fly, for testing?
by Eric Abrahamsen 23 May '18

23 May '18

I'm trying to set up a reproducible test environment for a MUA I'm working on, with accounts and dummy data that can be trashed and restored while testing. I'd like to exercise the IMAP client part of the MUA, and am looking into using a local dovecot instance to do that. I'm trying to make this as minimal-config as possible: ideally the test environment could create a dummy (virtual) user, insert dummy message data, allow the MUA to log in and manipulate the messages, and then destroy both user and message data at the end of the session. I have the sense that I'll be able to get there by shipping a custom config file along with the test library, that sets up a virtual user with a mail_location under /tmp, and then all operations are done with dovecot -c customconfig.conf Then the temp folder is trashed at the end of the session. Is this likely to work? Is anything likely to bite me? Thanks, Eric

1 0

v2.2.36 released
by Timo Sirainen 23 May '18

23 May '18

https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.tar.gz.sig This is the last planned v2.2.x release. We didn't fix everything reported (especially build changes) to try to minimize any unexpected breakages. v2.3.2 will be out with a lot of fixes hopefully in a few weeks. That will start becoming the recommended version to run then. * login-proxy: If ssl_require_crl=no, allow revoked certificates. Also don't do CRL checks for incoming client certificates. * stats plugin: Don't temporarily enable PR_SET_DUMPABLE while opening /proc/self/io. This may still cause security problems if the process is ptrace()d at the same time. Instead, open it while still running as root. + doveadm: Added mailbox cache decision&remove commands. See doveadm-mailbox(1) man page for details. + doveadm: Added rebuild attachments command for rebuilding $HasAttachment or $HasNoAttachment flags for matching mails. See doveadm-rebuild(1) man page for details. + cassandra: Use fallback_consistency on more types of errors - cassandra: Fix consistency=quorum to work - dsync: Lock file generation failed if home directory didn't exist - In some configs if namespace root directory didn't yet exist, Dovecot failed to create mailboxes.lock when trying to create mailboxes - Snippet generation for HTML mails didn't ignore &entities inside blockquotes, producing strange looking snippets. - imapc: Fix assert-crash if getting disconnected and after reconnection all mails in the selected mailbox are gone. - pop3c: Handle unexpected server disconnections without assert-crash - fts: Fixes to indexing mails via virtual mailboxes. - fts: If mails contained NUL characters, the text around it wasn't indexed. - Obsolete dovecot.index.cache offsets were sometimes used. Trying to fetch a field that was just added to cache file may not have always found it. - dict-sql: Fix crash when reading NULL value from database

1 0

XMPP notifications
by André Rodier 23 May '18

23 May '18

Hello all, What is the best way, using sieve, to send XMPP notifications? I am using Debian Stretch, with Dovecot core / sieve packages version 2.2.27-3+deb9u2. Should I use the enotify extension, or a script with extprograms extension? Thanks for your answers. -- André Rodier

2 2

Re: Lmtp issues on dovecot 2.3.x with big messages
by Michael Tratz 23 May '18

23 May '18

> >> Messages are being sent to dovecot LMTP by postfix. If I change this email > >> to another server with dovecot 2.2.x the same message are delivered > >> immediately. > > Confirmed. Starts to fail here around 30Mb. Tested with Swaks. > > > > Working on a fix... > > Problem found. It is an explicit limit of 40Mb (for the 30Mb I saw in my > tests, there was also a base64 encoding I forgot about). > > Will fix both the unhelpful error and the fact that there should be no > limit (currently) for LMTP. > Stephan, I’m having the same issue with LMTP and large messages with dovecot 2.3.x. Can you tell me which commit fixes this issue? I looked through the GitHub commits, but it’s not clear to me which commit fixes this issue. I’d like to apply the patch and re-compile dovecot for my machines instead of having to downgrade to 2.2.35. Thanks, Michael

3 3

lazy_expunge ...
by Matt Bryant 23 May '18

23 May '18

So I decided to configure this plugin and take it for a test drive .. configured using mdbox (main namespace is Maildir) .. So as per Wiki have the following namespaces defined ... location is held within db ... but basically Maildir:~/Maildir for inbox namespace ==== 8< =============== namespace inbox { list = yes type = private inbox = yes prefix = INBOX/ separator = / mailbox Drafts { auto = create special_use = \Drafts } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } mailbox Sent { auto = create special_use = \Sent } mailbox Archive { auto = create special_use = \Archive } } namespace lazyexpunge { prefix = .EXPUNGED/ hidden = yes list = children subscriptions = no separator = / location = mdbox:~/mdbox:INDEX=~/mdbox:MAILBOXDIR=expunged:LISTINDEX=expunged.list.index } ==================== Can see its working since can see files in the mdbox storage along with indexs etc ... but there seems little to no documentation on how to delete from the expunged namespace and atm trying to even search doesnt seem to work .. doveadm -Dvvv search -u matt(a)the-bryants.net mailbox .EXPUNGED/* subject space gets errors below .. and although says refer to server log .. nothing in there either .. mail_debug is on ... doveadm(matt(a)the-bryants.net): Debug: fts: Indexes disabled for namespace '' doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] doveadm(matt(a)the-bryants.net): Debug: .EXPUNGED/Trash/cobbler: Mailbox opened because: search doveadm(matt(a)the-bryants.net): Error: fts: Failed to sync mailbox .EXPUNGED: Mailbox doesn't exist: .EXPUNGED doveadm(matt(a)the-bryants.net): Error: Searching mailbox .EXPUNGED/Trash/cobbler failed: Internal error occurred. Refer to server log for more information. [2018-05-23 15:07:21] Any ideas is there any better doco around this plugin and use etc ... thanks & rgds Matt

2 6