- dovecot - dovecot.org

Re: Disconnected: Inactivity (no auth attempts in 180 secs)
by Joseph Tam 31 Oct '17

31 Oct '17

Alexandre <byalefp(a)yahoo.com.br> wrote: > I can send and receive mails using: > IMAP 143 with TLS OK, IMAP STARTTLS is working in some sense. (Your MTA handles SMTP, not dovecot.) > The hangup occours inside of my LAN using Outlook 2016, and Outside > also trying access on 4G from my Android smartphone. > > My goal is enable also POP3s and IMAPs using TLS. [voluminous diagnostics] I can't really see from what you present what the problem is. Can you report the output of openssl s_client -starttls imap {imap-server}:143 openssl s_client -starttls pop3 {imap-server}:110 (from both inside and outside), as well as any matching log entries. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Password encription
by Joseph Tam 30 Oct '17

30 Oct '17

> Aki, (Not speaking for Aki) > I understand that salted passwords saved in my database and stronger hash > algorithm course that it will require more processor time/power to crack my > passwords. > > But only when hackers have direct access to my database what means that > hackers have access to my passwords hashes (eg. hackers stolen my database). > > My Dovecot use passwords saved in database as SHA256 and hackers can use > only SMTP, IMAP or POP3 services to try crack it using dictionary attack (I > understand that they using plain text dictionaty passwords). > > Stronger hash algorithm and salt is useful when hackers have direct access > to my database but when they use services as SMTP, IMAP or POP3 > to crack passwords only longer and more complicated password can be more > secure. > > I do not understand this correctly ? Yes, your understanding is basically correct. However, history gives lots of examples of broken systems that explicitly or implicitly relied on one critical system not failing -- they lacked defense in depth or resilience. Examples are "this system has no bugs", "my system does not leak hashes", "this algorithm is unbreakable", "we'll never see a CAT5 hurricane", etc. If these critical assumption ever becomes untrue, the foundation of your defense crumbles. If you narrow your attack definition to only include in-protocol remote brute forcing, then any decent password will take far too long to break that way (esp. with throttling controls that are built-in). Your log files will overflow recording the attempts long before you can expect a password to be cracked. However, you're still susceptable to the qwerty passwords. If this is your *only* line of defense, it is brittle. A robustly secure system will overlap protection: strong hashes, password compliance systems, brute force countermeasures, file permissions/OS hardening, network origins vetting, anti-DoS measures, etc. Keep this picture in mind that I found on CLCERT https://www.clcert.cl/humor/img/weakest-link-road.jpg Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and the Maildir path
by Will Merkens 30 Oct '17

30 Oct '17

System basics Centos 7.3 Dovecot 2.2.32 (dfbe293d4) I am working on a replacement mail server for work and one of the features I wanted was ldap authentication After much fiddling I got it to work. But I encountered a issue where two different methods of testing a mail account resulted in the mail_location being different I set mail_location = maildir:/var/spool/maildir/%d/%n/Maildir in dovecot.conf when I test the authentication and to see if the folders are created correctly on first use I have two results depending on how I test. First test was from openssl openssl s_client -connect mail2:993 I have no problem connecting, I issue the following commands * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login testuser(a)userful.com ******** a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in a list "" * * LIST (\HasNoChildren) "." INBOX a OK List completed (0.001 + 0.000 secs). * BYE Disconnected for inactivity. closed But when I look in the mail server at /var/spool/maildir the testuser is not created inside of userful.com but at the same level as userful.com contrary to the %d in mail_location settings. Now second method doveadm -D mailbox list -u 'testuser(a)userful.com' This correctly creates the user under the domain as specified. for logs I have from journalctl for openssl Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=VgBmvMNcQoTAqHsn lip=192.168. 123.236 rip=192.168.123.39 lport=993 rport=33858 resp=AHRlc3R1c2VyQHVzZXJmdWwuY29tADk5dGVzdHVzZXI5OQ== (previous base64 data may contain sensitive data) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=posixAccount)(uid=testuser)) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser; uid unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): username changed testuser(a)userful.com -> testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client passdb out: OK 2 user=testuser original_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master in: REQUEST 2784755713 10725 2 d4a357fe811a1da8bd725b82fc1da2ab session_pid=11051 request_auth_token Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master userdb out: USER 2784755713 testuser home=/nfs/home/test-user uid=6000 gid=1000 auth_token=29e6ac32c85cf1b69eeabbe8e4f8e4810e9a3468 auth_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: imap-login: Login: user=<testuser>, method=PLAIN, rip=192.168.123.39, lip=192.168.123.236, mpid=11051, TLS, session=<VgBmvMNcQoTAqHsn> for doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: master in: USER 1 testuser(a)userful.com service=doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: userdb out: USER 1 testuser(a)userful.com home=/nfs/home/test-user uid=6000 gid=1000 Any ideas and any settings files that I need to post. -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

2 1

dovecot-2.3 (-git) Warning and Fatal Compile Error
by Reuben Farrelly 30 Oct '17

30 Oct '17

I haven't been tracking dovecot-2.3 until now, but I've just given it a quick run, and there are a few things that may need some attention. Linux x86-64, Gentoo, GCC-7.2.0 Dovecot 2.3 @ commit 32c2612514a404ebc226f32bb88f28d76ceb1db1 Compiled with: ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --disable-dependency-tracking --disable-silent-rules --docdir=/usr/share/doc/dovecot-9999_p20171018 --htmldir=/usr/share/doc/dovecot-9999_p20171018/html --libdir=/usr/lib64 --localstatedir=/var --with-moduledir=/usr/lib64/dovecot --without-stemmer --disable-rpath --with-icu --with-systemdsystemunitdir=/usr/lib/systemd/system --enable-maintainer-mode --with-bzlib --without-libcap --without-gssapi --without-ldap --with-lucene --with-lz4 --with-lzma --without-mysql --with-pam --without-pgsql --without-sqlite --without-solr --with-ssl --with-libwrap --without-textcat --without-vpopmail --with-zlib --disable-static Warnings: (Lots of this one...) /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c -o fts-user.lo fts-user.c libtool: compile: x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c fts-storage.c -fPIC -DPIC -o .libs/fts-storage.o <command-line>:0:0: warning: "_FORTIFY_SOURCE" redefined <built-in>: note: this is the location of the previous definition In file included from /usr/include/bits/libc-header-start.h:33:0, from /usr/include/stdlib.h:25, from ../../../src/lib/lib.h:11, from fts-storage.c:3: /usr/include/features.h:376:4: warning: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Wcpp] # warning _FORTIFY_SOURCE requires compiling with optimization (-O) ^~~~~~~ The build then fails entirely with this: /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018 -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dict -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dns -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-http -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-mail -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-smtp -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-fs -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-charset -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-auth -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-master -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-ssl-iostream -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-compression -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-settings -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-test -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-sasl -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-stats -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dcrypt -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-program-client -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/list -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index/raw -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/plugins/quota -DMODULEDIR=\""/usr/lib64/dovecot"\" -O0 -g -pipe -march=native -mtune=native -ggdb -c -o realpath.lo realpath.c edit-mail.c: In function ‘edit_mail_wrap’: edit-mail.c:235:14: error: too few arguments to function ‘mailbox_transaction_begin’ raw_trans = mailbox_transaction_begin(raw_box, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage-private.h:7:0, from edit-mail.c:16: /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage.h:651:1: note: declared here mailbox_transaction_begin(struct mailbox *box, ^~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted’: edit-mail.c:1662:2: error: too few arguments to function ‘edmail->wrapped->v.set_cache_corrupted’ edmail->wrapped->v.set_cache_corrupted(&edmail->wrapped->mail, field); ^~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted_reason’: edit-mail.c:1671:21: error: ‘struct mail_vfuncs’ has no member named ‘set_cache_corrupted_reason’; did you mean ‘set_cache_corrupted’? edmail->wrapped->v.set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~ set_cache_corrupted edit-mail.c: At top level: edit-mail.c:1701:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_get_real_mail, ^~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1701:2: note: (near initialization for ‘edit_mail_vfuncs.get_backend_mail’) edit-mail.c:1708:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_set_cache_corrupted, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1708:2: note: (near initialization for ‘edit_mail_vfuncs.set_cache_corrupted’) edit-mail.c:1710:2: warning: excess elements in struct initializer edit_mail_set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1710:2: note: (near initialization for ‘edit_mail_vfuncs’) make[4]: *** [Makefile:481: edit-mail.lo] Error 1 make[4]: *** Waiting for unfinished jobs.... Reuben

5 9

Re: Password encription
by Joseph Tam 29 Oct '17

29 Oct '17

Aki Tuomi wrote: > The use of salt, today, is to prevent the attacker from directly seeing > who has same passwords. Of course it also will make a rainbow table > attack less useful, Not just less useful, but almost infeasible. Given the use of random salts, you would have to generate (number of possible salts) rainbow tables. This drastically changes the CPU/storage tradeoffs. > but then again, no one uses rainbow tables anymore > since it takes about few minutes to brute force a password in the cloud > or on your home computer GPU. SHA512-CRYPT uses by default 4000 rounds > on dovecot, to make it more computationally expensive, but still it's > not very strong protection anymore. I know it is theoretically possible, but really, how feasible is it? The way people talk about it, they make it sound trivial. As a test, I just generated a hash using "doveadm pw". Any takers? {SHA512-CRYPT}$6$qyQANQFbQGqOSqHh$Z4YVIe.QakXtWs63lWUmzlseKpiFzfPCKhwM0NQk8jP6QeRmk6POkCdSrFBmVO2wh.dgPCPA7Gq3sNUeKOZLM/ > MD5 with or without salt can be ATTAcked at passwords per second speed, > so using CRAM-MD5 of DIGEST-MD5 is very very poor choice. Anything with > MD5 should not be used for passwords these days. > > With Dovecot 2.3 we are making BLF-CRYPT available on all platforms, and > also adding support for ARGON2 when you have libsodium available. Straight hashes, without question, are weak. I routinely break NTLM hashes with rainbow tables. I'm *not* arguing against the use of stronger hashes, I'm just skeptical of the FUD surrounding the user of older salted hashes. This is especially true if the hashes are guarded against leakage, as most are. Strong crypt-hashes are an extra layer of protection (defense in depth). This page (if you trust 3rd parties) will report whether a password was ever found in a breached databases. You can also download the SHA1 hashes of all their known cracked passwords. It's big -- 5.3Gb 7-zipped file. https://haveibeenpwned.com/Passwords "j.emerlik" further asks: > You mean that today they using encrypted passwords to seeing > who has same passwords using brute force, hashes dictionary attack ? They precompute hashes for large number of password candidates, then look up hashes in that table. Rainbow tables are a way of folding large tables into a smaller ones, trading off space for extra CPU time. However, for hashes that use non-trivial salts, you would need to precompute an astronomically large number of tables. An attacker might be better off with a straight CPU-bound brute force search. Joseph Tam <jtam.home(a)gmail.com>

3 3

Need help in understanding auth digest-md5 and realm
by Admin Beckspaced 28 Oct '17

28 Oct '17

Hello dovecot community, I've setup dovecot and need a bit help in understanding the auth mechanism digest-md5 and realm in 10-auth.conf I got auth_mechanisms = plain login digest-md5 cram-md5 apop #auth_realms = #auth_default_realm = So i got empty realms. Auth normally works fine and clients can auth with mechanism digest-md5 and I see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,46.85.229.153,<klUjO3FcTy8uVeWZ>): Generating DIGEST-MD5 from user 'user(a)temizbau.de', password 'xxxx' dovecot: auth: Debug: sql(user(a)gruene-wiesentheid.de,87.168.26.5,<ISVLQXFcT/xXqBoF>): Generating DIGEST-MD5 from user 'user@gruene-wiesentheid.de@', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)vitaler-genuss.de,81.209.203.170,<tzxyT3FcT9RR0cuq>): Generating DIGEST-MD5 from user 'user(a)vitaler-genuss.de', password 'xxxxxxxxxxx' But sometimes clients get a password mismatch and I the see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,80.187.103.15,<adzhAnVclmxQu2cP>): Generating DIGEST-MD5 from user 'user@temizbau.de@mail.beckspaced.com', password 'xxxx' dovecot: auth: Debug: sql(user(a)thansadet.com,87.218.86.165,<LWItYHVc6r1X2lal>): Generating DIGEST-MD5 from user 'user@thansadet.com@mail.beckspaced.com', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)plaa-thansadetresort.com,110.164.127.146,<aGhcvHBcStJupH+S>): Generating DIGEST-MD5 from user 'user@plaa-thansadetresort.com@imap.beckspaced.com', password 'xxxxxxxxxx' when there's a password mismatch I see a different user string for generating the digest-md5 hash. i suppose users use a different mail client and the mail client does things differently? How can I fix this password mismatch thing? Do i just need to set an auth_realms of some random string in the 10-auth.conifig Or does the auth_realms need to be a host name? Domain name of some sort? For the moment I just removed the digest-md5 mechanism ... Or could I just simply not offer that mechanism? If someone could shed some light on this I would be more than grateful ;) Thanks & greetings Becki

4 6

Quota warning executable can not log to /dev/stdout
by Michael Härtl 28 Oct '17

28 Oct '17

I'm running dovecot 2.2.27 in a alpine based docker container and want to log to /dev/stdout. I therefore added this setting: log_path = /dev/stdout Logging works fine so far. Now I've added a quota-warning script. With the log_path setting above the script creates warnings like: Oct 28 10:27:01 quota-warning: Error: Can't open log file /dev/stdout: No such device or address Oct 28 10:27:01 quota-warning: Fatal: master: service(quota-warning): child 460 returned error 75 When I change log_path to something like /tmp/dovecot.log everything works fine. Dovecot itself is started via s6 with a run script like this: #!/bin/sh exec /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf What could cause this issue and how could I fix it? For the record here's my doveconf -n output: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # OS: Linux 4.4.27-x86_64-jb1 x86_64 ext4 auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 100 log_path = /dev/stdout mail_gid = dovecot mail_home = /var/mail/domains/%d/%n mail_location = maildir:/var/mail/domains/%d/%n mail_max_userip_connections = 160 mail_plugins = " quota" mail_privileged_group = dovecot mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for user %u exceeded (Benutzer %u hat sein Speichervolumen ueberschritten) quota_grace = 10%% quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 80 %u %d } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 10001 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh group = dovecot unix_listener quota-warning { mode = 0666 user = dovecot } user = vmail } ssl_cert = </certs/fullchain.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } protocol imap { mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

2 2

How to check which version of openssl is getting compiled in into dovecot?
by krzf83＠gmail.com 27 Oct '17

27 Oct '17

I got multiple versions of openssl in my system. I compile dovecot with PKG_CONFIG_PATH=/usr/openssl-1.0.2l-fpic/lib/pkgconfig ./configure How do I check which version of openssl got compiled in? configure script does not show version. There seem to be no way to check it in compiled binary (?) My dovecot is still seen vulnerable by tls testing tools so I'm guessing wrong version of openssl got compiled it but there seem to be no way to check it.

3 7

secure setup for imap hibernation
by Arkadiusz Miśkiewicz 27 Oct '17

27 Oct '17

Hi. What's the approach for securely enabling imap hibernation in case when each user uses different uid and gid? Looks like none and 0666 on hibernation and imap master sockets is the only way? Thanks, -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 3

Re: Password encription
by Aki Tuomi 27 Oct '17

27 Oct '17

SHA512-CRYPT and PLAIN/LOGIN with SSL. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 12:07 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password encription What scheme and mechanism do you recommend? 2017-10-25 11:01 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > CRAM-MD5 should not be used. Its not terribly secure. > > > ---Aki TuomiDovecot oy > -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:58 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password > encription > Thx Aki, > with CRAP-MD5 as scheme and mechanism it's works corretlly. > > 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > > > PLAIN and LOGIN. > > > > > > > > --- > > Aki Tuomi > > Dovecot oy > > > > -------- Original message -------- > > From: "j.emerlik" <j.emerlik(a)gmail.com> > > Date: 25/10/2017 11:41 (GMT+02:00) > > To: Dovecot Mailing List <dovecot(a)dovecot.org> > > Subject: Password encription > > > > Hi, > > which authentication mechanism should I use for SHA-256 password schama ? > > Regards, > > Jack > > >

3 6