- dovecot - dovecot.org

seeking sasl configuration example
by shadrock uhuru 29 Apr '15

29 Apr '15

hi everyone could someone show me there sasl configuration section in their dovecot.conf, i have postfix and dovecot setup for virtual users (no system users) everything works fine including tls, i have tried various examples off the web for sasl but they either have obsolete parameters or are for a setup with system users, i would prefer to use dovecots sasl implementation. dovecot --version = 2.1.7 cat dovecot.conf ###################### ###################### disable_plaintext_auth = no mail_privileged_group = mail log_path = /var/log/dovecot.log # auth_verbose=yes # auth_debug=yes # auth_debug_passwords=yes mail_debug=yes # verbose_ssl=yes passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = "pop3 imap lmtp" protocol imap { mail_plugins = " autocreate" } plugin { autocreate = Trash autocreate2 = Sent autocreate3 = junk autosubscribe = Trash autosubscribe2 = Sent autosubscribe3 = junk } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } protocol lmtp { postmaster_address=postmaster(a)mydomain.com hostname=niya.mydomain.com } ssl_cert = </etc/ssl/certs/mailcert.pem ssl_key = </etc/ssl/private/mail.key ###################### ###################### thanks shadrock

2 2

CVE-2015-3420
by Edwardo Garcia 28 Apr '15

28 Apr '15

When can we expect 2.2.17 to resolve this?

3 6

Quotas not working after reboot
by Edgaras Lukoševičius 28 Apr '15

28 Apr '15

Hello, after rebooting my dovecot server quotas are no longer working. # dovecot --version 2.2.10 CentOS Linux release 7.0.1406 It is strange that restarting dovecot did not reveal this problem, but rebooting whole server did. Before reboot it was like this: # doveadm -D quota get -u test1(a)testdomain1.tld doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm 03NB0d9erYBwhnzXhbS66fLDMU8v4ZiCDQDM3tDHCKme4ujpHy/lRk33305AIO9UXtgHGFyJYSpcVgoVnXJQGpJBphGvkAF4XI1JGx83Dtlb44wgJ8ZBgOm4qSNOoQIXKv0NO35EwUohtYBMlDJKPRUTwRF93tW7RsfWZGVNi4Eo5k616Tn4ooU3JMXkQA8LZ5zzLllspBVDbyb4GPAmWiw== root@ovzcloud doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(test1(a)testdomain1.tld): Debug: Added userdb setting: plugin/quota=maildir:storage=512000000 doveadm(test1(a)testdomain1.tld): Debug: Added userdb setting: plugin/quota_rule=*:bytes=512000000 doveadm(test1(a)testdomain1.tld): Debug: Effective uid=997, gid=996, home=/home/vmail/t/e/testdomain1.tld/test1/ doveadm(test1(a)testdomain1.tld): Debug: Quota root: name=storage=512000000 backend=maildir args= doveadm(test1(a)testdomain1.tld): Debug: Quota rule: root=storage=512000000 mailbox=* bytes=512000000 messages=0 doveadm(test1(a)testdomain1.tld): Debug: Quota warning: bytes=486400000 (95%) messages=0 reverse=no command=quota-warning 95 test1(a)testdomain1.tld doveadm(test1(a)testdomain1.tld): Debug: Quota warning: bytes=409600000 (80%) messages=0 reverse=no command=quota-warning 80 test1(a)testdomain1.tld doveadm(test1(a)testdomain1.tld): Debug: Quota grace: root=storage=512000000 bytes=25600000 (5%) doveadm(test1(a)testdomain1.tld): Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/t/e/testdomain1.tld/test1/ doveadm(test1(a)testdomain1.tld): Debug: maildir++: root=/home/vmail/t/e/testdomain1.tld/test1, index=, indexpvt=, control=, inbox=/home/vmail/t/e/testdomain1.tld/test1, alt= doveadm(test1(a)testdomain1.tld): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(test1(a)testdomain1.tld): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= Quota name Type Value Limit % storage=512000000 STORAGE 0 500000 0 storage=512000000 MESSAGE 0 - Now after rebooting i get this output: # doveadm -D quota get -u test1(a)testdomain1.tld doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(test1(a)testdomain1.tld): Debug: Added userdb setting: plugin/quota=maildir:storage=512000000 doveadm(test1(a)testdomain1.tld): Debug: Added userdb setting: plugin/quota_rule=*:bytes=512000000 doveadm(test1(a)testdomain1.tld): Debug: Effective uid=997, gid=996, home=/home/vmail/t/e/testdomain1.tld/test1/ doveadm(test1(a)testdomain1.tld): Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/t/e/testdomain1.tld/test1/ doveadm(test1(a)testdomain1.tld): Debug: maildir++: root=/home/vmail/t/e/testdomain1.tld/test1, index=, indexpvt=, control=, inbox=/home/vmail/t/e/testdomain1.tld/test1, alt= doveadm(test1(a)testdomain1.tld): Debug: Namespace : type=private, prefix=POP3-MIGRATION-NS/, sep=, inbox=no, hidden=yes, list=no, subscriptions=yes location=pop3c: doveadm(test1(a)testdomain1.tld): Debug: fs: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(test1(a)testdomain1.tld): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(test1(a)testdomain1.tld): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(test1(a)testdomain1.tld): Error: Quota not enabled Quota name Type Value Limit % # egrep -v "^#|^$" /etc/dovecot/conf.d/90-quota.conf plugin { quota = maildir #quota_rule = *:storage=1G #quota_rule2 = Trash:storage=+100M # LDA/LMTP allows saving the last mail to bring user from under quota to # over quota, if the quota doesn't grow too high. Default is to allow as # long as quota will stay under 10% above the limit. Also allowed e.g. 10M. #quota_grace = 10%% quota_grace = 5%% quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } plugin { quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } plugin { #quota = dirsize:User quota #quota = maildir:User quota #quota = dict:User quota::proxy::quota #quota = fs:User quota } plugin { #quota = dict:user::proxy::quota #quota2 = dict:domain:%d:proxy::quota_domain #quota_rule = *:storage=102400 #quota2_rule = *:storage=1048576 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = dovecot unix_listener quota-warning { user = vmail } } service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 # You can choose any port you want } client_limit = 1 }

1 2

[dovecot] Extra help, Hotmail nightmare
by Jorge Bastos 28 Apr '15

28 Apr '15

Hi, Some extra help. How would I make hotmail accept my emails and not make them go to junk folder? Is there any trick to do this? Thanks in advanced, Jorge Bastos

5 5

[patch] TLS Handshake failures can crash imap-login
by Hanno Böck 27 Apr '15

27 Apr '15

Hi, I tracked down a tricky bug in dovecot that can cause the imap-login and pop3-login processes to crash on handshake failures. This can be tested by disabling SSLv3 in the dovecot config (ssl_protocols = !SSLv2 !SSLv3) and trying to connect with openssl and forced sslv3 (openssl s_client -ssl3 -connect localhost:995). This would cause a crash. What was going on is this: In ssl-proxy-openssl.c in line 545 in the function ssl_step() the function ssl_handshake() is called. There SSL_accept() is called. If SSL_accept failes - because a client sent an invalid packet or something the server doesn't support or any other reason - ssl_handle_error() will be called. ssl_handle_error() will call ssl_proxy_destroy(). ssl_proxy_destroy() will then call ssl_proxy_flush(). And ssl_proxy_flush will call ssl_step() again. Here we have a loop. Now when SSL_accept() gets called again on the same context this is an invalid state for OpenSSL and it crashes. What to do? In essence, if ssl_proxy_destroy is called it shouldn't try to finish the handshake if the handshake hasn't even started due to an error. This can be done by a simple if check, see attached patch. I think this should do it. I have seen that a bug that is probably rootet in this has been posted here before regarding ssl3-disabled configs: http://dovecot.org/pipermail/dovecot/2015-March/100188.html cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno(a)hboeck.de GPG: BBB51E42

5 10

Using Identities to send Emails, question on Email Storage
by Kevin Laurie 27 Apr '15

27 Apr '15

hi, i was wondering that when sending mail with a different identity(bob(a)mydomain.com using help(a)mydomain.com identity), why does it not copy the message to help(a)mydomain.com(Sent box). instead it only shows it on bob(a)mydomain.com(Sent box). appreciate if someone could advise. could someone advise how to fix this as i would like to see the message in help(a)mydomain.com(SentBox) too. thanks kevin

2 1

Re: Encrypt messages on filesystem
by Nicolás Reynolds 27 Apr '15

27 Apr '15

Jorge Bastos <mysql.jorge(a)decimal.pt> writes: > Hi, > > > > If for some reason I want the received messages to be automatic encrypted on > the file system, how should/to do it? > > If there's any nice howto out there please let me know. you can take a look at gpgit, there's a way to use it with pigeonhole -- }(:=

1 0

TLS OCSP Stapling
by T.Tributh 26 Apr '15

26 Apr '15

Hi, is there a plan to support TLS OCSP stapling in the near future? Regards Torsten

1 0

Encrypt messages on filesystem
by Jorge Bastos 26 Apr '15

26 Apr '15

Hi, If for some reason I want the received messages to be automatic encrypted on the file system, how should/to do it? If there's any nice howto out there please let me know. Thanks in advanced,

1 0

prefetch not working (for me) on ldap user backend
by Hector M. Jacas 26 Apr '15

26 Apr '15

Dear Sir, I'm having problems with the implementation of prefetch userdb. Following the directives from the site (http://wiki2.dovecot.org/UserDatabase/Prefetch) I am unable to avoid the second search to the user backend (ldap). Could give me any advice or tips to achieve my goal? Thanks a lot, Hector M. Jacas My ldap has the following structure: search base: ou=Domains,dc=test,dc=local ******************************* domains tree: domain2.com: dc=domain2.com,ou=Domains,dc=test,dc=local Definition of mailuser1 on domail2.com: dn: uid=mailuser1,dc=domain2.com,ou=Domains,dc=test,dc=local uid: mailuser1 cn: User mailuser1 sn: User 1 displayName: User mailuser1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top mail: mailuser1(a)domain2.com ************************************* domain1.com: dc=domain1.com,ou=Domains,dc=test,dc=local Definition of mailuser1 on domain1.com: dn: uid=mailuser1,dc=domain1.com,ou=Domains,dc=test,dc=local uid: mailuser1 cn: User mailuser1 sn: User 1 displayName: User mailuser1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top mail: mailuser1(a)domain1.com ************************************* /etc/dovecot/dovecot-ldap.conf.ext content: hosts = ldapserver auth_bind = yes ldap_version = 3 tls = no base = ou=Domains,dc=test,dc=local scope = subtree user_filter = (&(objectclass=inetOrgPerson)(mail=%u)) user_attrs = =home=/var/vmail/mailboxes/%Ld/%Ln/%Ln,=uid=500,=gid=500 default_pass_scheme = CRYPT pass_filter = (&(objectclass=inetOrgPerson)(mail=%u)) pass_attrs = uid=user,password=userPassword,=userdb_home=/var/vmail/mailboxes/%Ld/%8Ln/%Ln, \ =userdb_uid=500,=userdb_gid=500 iterate_attrs = mail=user iterate_filter = (objectclass=inetOrgPerson) ************************************ auth test result for mailuser1(a)domain2.com: # doveadm mailuser1(a)domain2.com password auth test passdb: mailuser1(a)domain2.com auth succeeded Extra fields: user=mailuser1 And in /var/log/maillog (enabled debug auth options): Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: auth client connected (pid=0) Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: client in: AUTH 1 PLAIN service=doveadm resp=<hidden> Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1(a)domain2.com): bind search: base=ou=Domains,dc=test,dc=local filter=(&(objectclass=inetOrgPerson)(mail=mailuser1(a)domain2.com)) Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1(a)domain2.com): result: uid=mailuser1; uid unused Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: auth(mailuser1(a)domain2.com): username changed mailuser1(a)domain2.com -> mailuser1 Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1): result: uid=mailuser1 Apr 26 14:00:33 nfs-7-00 dovecot: auth: Debug: client passdb out: OK 1 user=mailuser1 ***************************** mailuser1(a)domain2.com doveadm user result: # doveadm user mailuser1(a)domain2.com field value uid 500 gid 500 home /var/vmail/mailboxes/domain2.com/mailuser1/mailuser1 maildir mail: /var/vmail/mailboxes/domain2.com/mailuser/mailuser1:INDEX=MEMORY And in /var/log/maillog (enabled debug auth options): Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: master in: USER 1 mailuser1(a)domain2.com service=doveadm Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: prefetch(mailuser1(a)domain2.com): passdb didn't return userdb entries, trying the next userdb Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1(a)domain2.com): user search: base=ou=Domains,dc=test,dc=local scope=subtree filter=(&(objectclass=inetOrgPerson)(mail=mailuser1(a)domain2.com)) fields= Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1(a)domain2.com): result: uid=mailuser1 cn=Usuario mailuser1 sn=Usuario 1 displayName=Usuario mailuser1 objectClass=inetOrgPerson,inetOrgPerson,inetOrgPerson,inetOrgPerson mail=mailuser1(a)domain2.com; objectClass,cn,uid,mail,displayName,sn unused Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: ldap(mailuser1(a)domain2.com): result: uid=mailuser1 cn=Usuario mailuser1 sn=Usuario 1 displayName=Usuario mailuser1 objectClass=inetOrgPerson,inetOrgPerson,inetOrgPerson,inetOrgPerson mail=mailuser1(a)domain2.com; objectClass,cn,uid,mail,displayName,sn unused Apr 26 14:01:19 nfs-7-00 dovecot: auth: Debug: userdb out: USER 1 mailuser1(a)domain2.com home=/var/vmail/mailboxes/domain2.com/mailuser1/mailuser1 uid=500 gid=500 *************************** My base system is RHEL7, 24 CPUs and 16GB ram and for LDAP backend, 389 DS 1.2.2 on RHEL 6.6 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-123.20.1.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.0 (Maipo) nfs4 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_client_limit = 50000 disable_plaintext_auth = no listen = * mail_fsync = always mail_gid = 500 mail_location = maildir:/var/vmail/mailboxes/%d/%8n/%n:INDEX=MEMORY mail_nfs_index = yes mail_nfs_storage = yes mail_uid = 500 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } service auth { unix_listener auth-userdb { group = vmail mode = 0640 user = vmail } } service doveadm { inet_listener { port = 24245 } } service imap-login { process_min_avail = 24 service_count = 0 } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = group = idle_kill = 0 privileged_group = process_limit = 8192 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 8192 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { process_limit = 8192 } service pop3-login { process_min_avail = 24 } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol imap { mail_max_userip_connections = 1000 } local 172.28.200.0/24/24 { doveadm_password = secret } --- This message was processed by Kaspersky Mail Gateway 5.6.28/RELEASE running at host imx3.etecsa.cu Visit our web-site: <http://www.kaspersky.com>, <http://www.viruslist.com>

1 0