<div style="font-family: Arial, sans-serif; font-size: 14px;"><span>Hi,</span><div><br></div><div><span>Thanks for the notice! But yes, I was aware of this. For future reference though, would you mind telling me how I would go about doing this? I take it I'd first have to re-encrypt the user keys, before changing the account password. So before changing the password for a user in my PostgreSQL database, I would do the following:</span></div><div><br></div><div><span>doveadm mailbox cryptokey password -u 'user@example.com' -o <hex-encoded sha256-hashed old password> -n <hex-encoded sha256-hashed new password></span></div><div><br></div><div><span>since I am using encode(digest('%w', 'sha256'), 'hex') in the PostgreSQL password_query.</span></div><div><br></div><span>Can you confirm that this is the correct way to change the user keys' password? Thanks.</span><br></div><div class="protonmail_quote">
------- Original Message -------<br>
On Saturday, March 4th, 2023 at 16:41, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:<br><br>
<blockquote class="protonmail_quote" type="cite">
<div>
Dovecot tries to hide passwords in logs so you're probably safe.
</div>
<div class="default-style">
</div>
<div class="default-style">
Remember that there is no automatic password change for mail crypt. If user's password is changed, it will require corresponding update for user's master key.
</div>
<div class="default-style">
</div>
<div class="default-style">
Aki
</div>
<blockquote type="cite">
<div>
On 04/03/2023 17:07 EET Jeremy <mailinglist-subscriptions@protonmail.com> wrote:
</div>
<div>
</div>
<div>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
Hi,
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
Yeah, I just realized myself that what I did there was probably not the smartest thing to do, as I indeed figured dovecot would probably just use that as a plain text string. ;-) I've now opted to do the following (I'm using PostgreSQL BTW):
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
password_query = SELECT \
<div>
email as user, password, \
</div>
<div>
encode(digest('%w', 'sha256'), 'hex') AS userdb_mail_crypt_private_password \
</div>
<div>
FROM virtual_users WHERE email='%u';
</div>
<div>
</div>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
Please advice if you think that this is more sensible.
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
Also, could you give an overview of in which logs and/or other locations these passwords might show up? I'd like to clean up after myself.
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
Thanks in advance.
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px; color: #000000;">
</div>
<div class="protonmail_quote">
------- Original Message -------
<br>On Saturday, March 4th, 2023 at 15:38, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:
<br>
<br>
<blockquote type="cite">
<div>
Hi,
</div>
<div class="default-style">
</div>
<div class="default-style">
just to mention this. If you use the stored password hash, it equals to using a plain text string. Depending on your threat model it might or not be an issue that admins have access to the password used to encrypt mails.
</div>
<div class="default-style">
</div>
<div class="default-style">
Aki
</div>
<blockquote type="cite">
<div>
On 04/03/2023 16:12 EET Jeremy <<a rel="noreferrer nofollow noopener" target="_blank" href="mailto:mailinglist-subscriptions@protonmail.com">mailinglist-subscriptions@protonmail.com</a>> wrote:
</div>
<div>
</div>
<div>
</div>
<div>
Hi again,
</div>
<div>
</div>
<div>
I was able to solve both questions. I was overthinking things.
</div>
<div>
</div>
<div>
A solution to the first question about mail_attribute_dict was simply to use other available variables to point to the virtual user's maildir paths. Like so: /var/mail/%d/%u/dovecot-attributes
</div>
<div>
</div>
<div>
As for the second question:
</div>
<div>
When I asked it, I was uncertain if dovecot would be able to cope with a hashed password for userdb_mail_crypt_private_password. I somehow believed dovecot required a plain text password there, as per the '%w' in the example password_query. Turns out this was not the case. Simply providing the already hashed password of the password field did the trick. So:
</div>
<div>
</div>
<div>
password_query = SELECT \
</div>
<div>
email as user, password, \
</div>
<div>
password AS userdb_mail_crypt_private_password \
</div>
<div>
FROM virtual_users WHERE email='%u';
</div>
<div>
</div>
<div>
Hope this is of help to others if they stumble upon this question.
</div>
<div>
</div>
<div>
------- Original Message -------
</div>
<div>
On Thursday, February 23rd, 2023 at 08:53, Jeremy <<a rel="noreferrer nofollow noopener" target="_blank" href="mailto:mailinglist-subscriptions@protonmail.com">mailinglist-subscriptions@protonmail.com</a>> wrote:
</div>
<div>
</div>
<blockquote type="cite">
<div>
Hi again,
</div>
<div>
</div>
<div>
I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts.
</div>
<div>
</div>
<div>
After an initial topic from me about encrypting already existent mail, I could now use some pointers on how to set up the mail-crypt plugin for pure virtual accounts (i.e. that have no matching system users and/or home directories. I hope somebody can clarify a few things that are not entirely clear to me yet.
</div>
<div>
</div>
<div>
After doing my own research, I believe the following should be possible:
</div>
<div>
</div>
<div>
I'd like to use the password of virtual email accounts to let dovecot encrypt/decrypt the keys needed to encrypt/decrypt the mail in the relevant folders.
</div>
<div>
</div>
<div>
As per the documentation @ <a rel="noreferrer nofollow noopener" target="_blank" href="https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/">https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/</a> I believe this would be all the configuration I need:
</div>
<div>
</div>
<div>
# Config
</div>
<div>
mail_attribute_dict = file:%h/Maildir/dovecot-attributes
</div>
<div>
mail_plugins = $mail_plugins mail_crypt
</div>
<div>
</div>
<div>
plugin {
</div>
<div>
mail_crypt_curve = secp521r1 # or some other preferred curve
</div>
<div>
mail_crypt_save_version = 2
</div>
<div>
mail_crypt_require_encrypted_user_key = yes # necessary for encrypting keys with user password
</div>
<div>
}
</div>
<div>
</div>
<div>
# File: /etc/dovecot/dovecot-sql.conf.ext
</div>
<div>
password_query = SELECT \
</div>
<div>
email as user, password, \
</div>
<div>
'%w' AS userdb_mail_crypt_private_password \
</div>
<div>
FROM virtual_users WHERE email='%u';
</div>
<div>
</div>
<div>
My first question is:
</div>
<div>
Is it possible to configure mail_attribute_dict in such a way as to not use home directories. Since I only use virtual accounts, without those accounts having home directories, can I somehow tell dovecot to save the attributes into the PostsreSQL database, for instance? If not, can you suggest another approach, without having to create home directories for virtual users?
</div>
<div>
</div>
<div>
My second question is:
</div>
<div>
The documentation warns about not using password directly in the above SQL query:
</div>
<div>
</div>
<blockquote type="cite">
<div>
Choosing encryption key
</div>
</blockquote>
<blockquote type="cite">
<div>
DO NOT use password directly. It can contain % which is interpreted as > variable expansion and can cause errors.
</div>
</blockquote>
<div>
</div>
<div>
Does this refer to not accidentally substituting '%w' with password? In other words, if I leave the above query as is, should I be good, even if plain text passwords of users potentially have % signs in them? Or would I need to take further measurements? (The passwords in my database are already hashed, by the way).
</div>
<div>
</div>
<div>
I hope somebody can offer some guidance on this. Thanks.
</div>
</blockquote>
</blockquote>
<div class="default-style">
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</blockquote>
</div>
</blockquote>
<div class="default-style">
</div>
<div class="io-ox-signature">
<pre>---
Aki Tuomi</pre>
</div>
</blockquote><br>
</div>