- dovecot - dovecot.org

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot reposting inactivity as auth failed
by pedro＠netsecpt.pt 21 Jun '23

21 Jun '23

Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Dovecot Version : 2.3.19.1 (9b53102964) Log imap line with issues : dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<myemail@mydomain>, method=PLAIN, rip=xxx.xxx.xx.xx, lip=xxx.xxx.xxx.xxx, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<some_hash> Thank you

3 6

Submission behaviour
by André Rodier 20 Jun '23

20 Jun '23

Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password. Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server. Here an example, of nftable ruleset, for dovecot imap(s): ------------------------------------------------------------------- table inet filter { set banned_imap_ipv4 { type ipv4_addr flags dynamic,timeout timeout 1d } set banned_imap_ipv6 { type ipv6_addr size 65535 flags dynamic,timeout timeout 1d } chain input { # Limit new imap connections ala fail2ban meta nfproto ipv4 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } meta nfproto ipv6 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr } # Reject the traffic explicitly ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited tcp dport { imap, imaps } ct state new counter accept \ comment "Accept imap/imaps connections" } } ------------------------------------------------------------------- Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android. There is also a way to save the rules before restarting the firewall, which works very well as well: ------------------------------------------------------------------- # nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } } ------------------------------------------------------------------- Now, the question I have is this. I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP. However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587) Thanks for your insights.

1 0

Re: Dovecot reposting inactivity as auth failed
by Joseph Tam 20 Jun '23

20 Jun '23

From: pedro(a)netsecpt.pt > Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . > Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Putting aside the semantics that not supplying credentials before the timeout *is* an auth failure, I would think the best way to handle this is to change the pattern fail2ban triggers to be more specific about what it considers an auth failure. If this is a typical log entry you want to avoid an automatic ban dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user= ... I would modify /etc/fail2ban/filter.d/dovecot.conf to limit it to 0-99sec like so failregex = ...( in \d{1,2} secs)... Some BFD attempts will leak through but it avoids triggering on any inactivity >99s. Joseph Tam <jtam.home(a)gmail.com>

1 0

Cannot get mail-crypt plugin to work
by rcooper＠dwford.com 16 Jun '23

16 Jun '23

dovecot 2.2.27 and then 2.2.36 (tried both) Trying to enable mail-crypt in global key mode. Nothing is ever encrypted, even when I move mail from folder to folder. I have tried everything available to find here, google, etc and I assume I am missing something fundamental. Debug log shows the plugin loading Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Loading modules from directory: /usr/lib/dovecot Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Module loaded: /usr/lib/dovecot/lib10_mail_crypt_plugin.so Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled (I assume because global not per user) my 10-mailcrypt.conf in .conf.d mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_global_private_key = </certs/ecprivkey.pem mail_crypt_global_public_key = </certs/ecpubkey.pem mail_crypt_save_version = 2 } I have also tried base64 encoded .pem files inline. I have also added the mail_plugins line to my protocol definitions to no avail and when I do that dovecot -n shows the lines as mail_plugins = " mail_crypt mail_crypt" so I assume it's a mistake to add mail_plugins = $mail_plugins mail_crypt to the protocol sections. Some online tutorials say must do this and others do not mention it at all. Just looking for some guidance as to where to go next.

3 4

zlib compressed folders
by Michael Grant 15 Jun '23

15 Jun '23

I’ve been playing with zlib compressed mail archives. I can’t seem to get it to work. I followed the instructions here: https://doc.dovecot.org/configuration_manual/zlib_plugin/ I’m not interested in being able to save, just read-only would be great. I have some compressed mail archives, for example 2020.gz in my ~/mail/ directory. I have some uncompressed ones too like 2021. Both are mbox formatted. In my imap client, I see both 2020.gz and 2021 as imap folders. I can access mail in 2021 but not in 2020.gz. It just says it’s empty. My local.conf has this in it: mail_plugins = $mail_plugins zlib I know for sure this is being read because if I change this to some non-existent plugin, I see an in the log complaining about a non-existent plugin. I’ve tried also adding in the lines for saving but no difference. Would love to know if there’s something more I need to do. Also, should I expect to see a folder named 2020 instead of 2020.gz in my imap clients? My suspicion is that dovecot is treating these as uncompressed imap folders which it can’t read because they look like garbage. Is there some doveadm command to get it to re-scan folders that I need to run and then realize this is a folder using zlib? Michael Grant

3 3

Empty oldstats
by djdejawu＠gmail.com 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964) BR, DeJa

1 0

Empty oldstats
by DeJa Wu 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964)

1 0

Panic: file acl-backend-vfile.c: line 123 on access from Nextcloud Imap-Client
by forum＠xp8.de 15 Jun '23

15 Jun '23

Hello, with activated imap_aci i get the following error: Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Panic: file acl-backend-vfile.c: line 123 (acl_backend_vfile_get_local_dir): assertion failed: (list == ns->list) Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f4d46caede6] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f4d46caef02] -> /usr/lib/dovecot/libdovecot.so.0(+0x109cdb) [0x7f4d46cbbcdb] -> /usr/lib/dovecot/libdovecot.so.0(+0x109d77) [0x7f4d46cbbd77] -> /usr/lib/dovecot/libdovecot.so.0(+0x5cf73) [0x7f4d46c0ef73] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x7fbf) [0x7f4d4696dfbf] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xb795) [0x7f4d46971795] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_object+0x69) [0x7f4d46971499] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_rights+0x13) [0x7f4d469714c3] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x8e53) [0x7f4d4696ee53] -> /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so(+0x3975) [0x7f4d46960975] -> dovecot/imap(command_exec+0xa4) [0x55d9dc7f6364] -> dovecot/imap(+0x22312) [0x55d9dc7f4312] -> dovecot/imap(+0x223c4) [0x55d9dc7f43c4] -> dovecot/imap(client_handle_input+0x1bd) [0x55d9dc7f47cd] -> dovecot/imap(client_input+0x74) [0x55d9dc7f4d94] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f4d46cd1f8d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f4d46cd368a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f4d46cd2034] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f4d46cd21f0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f4d46c446c7] -> dovecot/imap(main+0x4ea) [0x55d9dc7e5d0a] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f4d469add90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f4d469ade40] -> dovecot/imap(_start+0x25) [0x55d9dc7e5da5] Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Fatal: master: service(imap): child 439797 killed with signal 6 (core dumped) Bug? Any Ideas? Greets! root@konsrvdata2:/etc/dovecot/conf.d# dovecot --version 2.3.16 (7e2e900c1a) root@konsrvdata2:/etc/dovecot/conf.d# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-67-generic x86_64 Ubuntu 22.04.2 LTS ext4 # Hostname: konsrvdata2 auth_mechanisms = plain cram-md5 auth_username_format = %Ln disable_plaintext_auth = no mail_home = /srv/dovecot/home/%d/%n/ mail_location = maildir:/srv/dovecot/mail/%d/%n/ mail_plugins = acl mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/srv/dovecot/mail/waldkindergarten-ts:INDEXPVT=/srv/dovecot/mail/xp8it/shared/waldkindergarten-ts prefix = shared/%%u/ separator = / type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile acl_defaults_from_inbox = yes acl_shared_dict = file:/srv/dovecot/db/shared-mailboxes.db sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve sieve" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/dovecot/private/imap.konis.info.fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail driver = static } protocol lmtp { mail_plugins = acl sieve } protocol lda { mail_plugins = acl sieve } protocol imap { mail_plugins = acl imap_acl }

1 0

Re: imap syncing issues
by dovecot＠x9p.org 14 Jun '23

14 Jun '23

Paul Kudla already suggested setting fetch intervals and to avoid microsoft clients. You can debug the issue with tcpdump like this: # tcpdump -X -s100 -nni lo0 port 143 (replace lo0 for lo, eth0 or the name of your interface) disable all clients, enable the one you want to debug/see the commands. me deleting a message and client issuing the command: 14:40:17.386079 127.0.0.1.48376 > 127.0.0.1.143: P 1410:1437(27) ack 177507 win 256 <nop,nop,timestamp 1610013520 2861364932> (DF) ......(REDACTED) 0030: aa8c f6c4 3131 3120 7569 6420 6d6f 7665 ....111 uid move 0040: 2034 3732 3920 2254 7261 7368 220d 0a 4729 "Trash".. 14:40:17.486259 127.0.0.1.143 > 127.0.0.1.48376: P 177507:177624(117) ack 1437 win 256 <nop,nop,timestamp 2861364932 1610013520> (DF) ......(REDACTED) 0030: 5ff6 db50 2a20 4f4b 205b 434f 5059 5549 _..P* OK [COPYUI 0040: 4420 3136 3830 3237 3234 3630 2034 3732 D 1680272460 472 0050: 3920 3132 365d 204d 6f76 6564 2055 4944 9 126] Moved UID Cheers, x9p On 6/14/23 17:19, Michael Grant wrote: > > Yes, I’m the sole person responsible for messing this up. My Linux > machine, my server, I installed it, I configured it, perhaps I caused > this.... > > It could be some misbehaving imap client that is causing this, that’s > one of the things I’m trying to understand. I don’t see any errors in > the mail log which is where dovecot logs to. All the clients are as > up to date as possible. > > One way forward that I know of is to remove all the imap clients and > start over, adding one by one seeing if it starts breaking again. I > was hoping first to see if I could figure out what’s gone wrong before > doing this. > > *From: *dovecot(a)x9p.org > *Sent: *14 June 2023 18:05 > *To: *Michael Grant <mailto:mgrant@grant.org>; dovecot(a)dovecot.org > *Subject: *Re: imap syncing issues > > The issue seems to be with the clients (an update maybe?), not the server. > > do you have console/root access to dovecot and files? > > On 6/14/23 11:17, Michael Grant via dovecot wrote: > > I’m having synchronization issues in imap. I am accessing my mail > from several different imap clients: K9 on Android, Windows 11 and > 10 mail client, and Android Gmail app. Both desktop and laptop, > tablet, phone. I know I have more than the usual number of imap > connections... > > Often when I delete a message in one place, it doesn’t get deleted > in another. For example, if I delete a message on K9 then open my > laptop, it’s still there in W11 Mail. But just now, I deleted > some messages on my laptop and swiped down on K9 and the message > disappeared on K9. But K9 shows other messages which have been > deleted in Windows 11 Mail. I’ve not yet been able to figure out > a pattern. It’s annoying me. I have to delete messages in > several different places. Messages not coming back, they’re just > not being deleted in one place and that delete operation is not > syncing to the others. > > Messages seem to be being marked as read properly across devices. > This seems to be an issue with delete only, so far as I’ve noticed. > > I’ve long been using multiple imap clients, this syncing issue > started maybe 6 to 8 months ago. > > Is there a good way to get debugging info out of dovecot as to > what the clients are doing? > > Or does anyone have any advise which might help resolve this > without resorting to me digging into the imap protocol? > > Michael Grant > > > > _______________________________________________ > > dovecot mailing list --dovecot(a)dovecot.org > > To unsubscribe send an email todovecot-leave(a)dovecot.org >

1 0