January 2014 - dovecot

[Dovecot] Possible to force cipher order?
by Matthias Rieber 10 Jan '14

10 Jan '14

Hi, is it possible to force the server cipher order instead of the clients preferences? When I connect with openssl using these ciphers: 'RC4-SHA:DHE-RSA-AES256-GCM-SHA384' -> RC4-SHA will be selected and with 'DHE-RSA-AES256-GCM-SHA384:RC4-SHA' -> DHE-RSA-AES256-GCM-SHA384 It seems to be recommended for webservers to override that due to bad clients choices and increasing knowledge, like RC4 vs. BEAST, AES128 better (theoretical) than AES256. Regards, Matthias

1 1

[Dovecot] Message filtering capability at IMAP proxy
by CM Reddy 10 Jan '14

10 Jan '14

Hi, I would like process the messages at Dovecot IMAP proxy. In one of the documents, it was mentioned that Dovecot proxy currently supports on the fly message filtering in latest releases. Will it it possible to extend the filtering feature to handle the following requirements. 1. Parse the email at IMAP proxy. 2. Replace the links with some other secure links. 3. Replace the attachments with some other document. It would be great, if any one can provide some pointers to move forward. - Thanks in advance CM Reddy

2 1

Re: [Dovecot] imap auto create mailbox: we're not in group 8(mail)
by Joseph Tam 09 Jan '14

09 Jan '14

Adrian Zaugg writes: > How can I configure the auto create mailbox feature that it works and > let run LMTP and IMAP process as user %u and group mail and let create > the mailboxes in /var/mail as (example user tester) with the following > permissions: > > /var/mail: > > drwxrwx--x root mail 3072 Dec 18 01:43 . > drwx------ tester tester 1024 Jan 09 12:53 tester This is probably what you need: # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. # Typically this is set to "mail" to give access to /var/mail. mail_privileged_group = mail > ...or do I need a different approach? You could also chmod 1777 /var/mail but this will allow arbitrary uses who have filesystem access to create their own files here, and maybe DoS a new user from being created (or maybe even anticipate a new mailbox, create one with mode 0777 and wait to intercept mail?). Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] LDA quota rejection
by Davide 09 Jan '14

09 Jan '14

Hi to all, i have dovecot 2.2.5 and i have implemented lda rejection through quota full this is my dovecot conf protocol lda { mail_fsync = optimized auth_socket_path = /usr/local/var/run/dovecot/auth-userdb deliver_log_format = msgid=<%f>-<%s>-%m: %$ hostname = mail.cgilfe.it info_log_path = /var/log/dovecot/dovecot-deliver.log log_path = /var/log/dovecot/dovecot-deliver.log mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = $mail_plugins mail_log sieve postmaster_address = postmaster(a)mail.cgilfe.it rejection_subject = Rifiutato: %s rejection_reason = Messaggio a <%t> automaticamente rifiutato:%n%r submission_host = 192.16X.XXX.XX0 } If user over quota receive a messagge internally all is ok but if the user receive a mail from external domains nothing to the sender is sentback. Thanks in advance to all for possible help. -- *Davide Marchi* *T*eorema *F*errara *Srl* Via Spronello, 7 - Ferrara - 44121 Tel. *0532783161* Fax. *0532783368* E-m@il: *davide.marchi(a)mail.cgilfe.it* Skype: *davide.marchi73* Web: *http://www.cgilfe.it* *CONFIDENZIALITA'* *Ai sensi del D.Lgs. 196/2003 si precisa che le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario/dei destinatari. Qualora il messaggio in parola Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo e a non inoltrarlo a terzi, dandocene gentilmente comunicazione.* *Per favore, pensa all'ambiente. Stampa questa email solo se necessario.*

4 3

[Dovecot] imap auto create mailbox: we're not in group 8(mail)
by Adrian Zaugg 09 Jan '14

09 Jan '14

Dear List Somehow I don't understand the intended work flow to have new mailboxes auto created. On login of a new user with no mailbox, I get 2014-01-09 12:53:06 imap(tester): Error: user tester: Initialization failed: Namespace '': mkdir(/var/mail/tester) failed: Permission denied (euid=1016(tester) egid=1016(tester) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0771) The imap process runs as the user the login performed and thus it has only the privileges of that user. This is good and desired, when a mailbox already exists. I do not want to allow all users to write to /var/mail, only they should write to their dirs inside /var/mail. Same story for LMTP, if no mailbox exists yet: 2014-01-09 13:01:47 lmtp(20416, tester): Error: user tester: Initialization failed: Namespace '': mkdir(/var/mail/tester) failed: Permission denied (euid=1016(tester) egid=1016(tester) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0771) How can I configure the auto create mailbox feature that it works and let run LMTP and IMAP process as user %u and group mail and let create the mailboxes in /var/mail as (example user tester) with the following permissions: /var/mail: drwxrwx--x root mail 3072 Dec 18 01:43 . drwx------ tester tester 1024 Jan 09 12:53 tester ...or do I need a different approach? Thank you for helping me. Best regards, Adrian. My setup: ======== * Exim delivers to LMTP socket as user %u, group mail * maildir storage in /var/mail doveconf -n: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.3 ext3 auth_cache_negative_ttl = 0 auth_cache_size = 5 M auth_cache_ttl = 4 hours auth_failure_delay = 3 secs auth_mechanisms = plain login digest-md5 cram-md5 apop rpa auth_username_format = %n auth_verbose = yes auth_worker_max_count = 128 first_valid_gid = 1000 first_valid_uid = 1000 last_valid_gid = 60000 last_valid_uid = 60000 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /var/log/dovecot/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = maildir:/var/mail/./%u/:INDEX=MEMORY mail_prefetch_count = 1024 maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vacation-seconds namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { args = scheme=SHA512-CRYPT username_format=%u /etc/cram-md5.pwd driver = passwd-file } plugin { sieve = /var/mail/%u/sieve/.dovecot.sieve sieve_before = /var/mail/%u/sieve/vacation.sieve sieve_dir = /var/mail/%u/sieve sieve_extensions = +vacation +vacation-seconds sieve_max_actions = 1024 sieve_vacation_default_period = 12d sieve_vacation_max_period = 0 sieve_vacation_min_period = 1d } postmaster_address = postmaster@XXXX protocols = " imap lmtp sieve pop3" service auth-worker { user = $default_login_user } service auth { group = mail-security unix_listener auth-client { mode = 0660 user = Debian-exim } unix_listener auth-userdb { mode = 0666 } user = $default_internal_user } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 5 } service lmtp { process_min_avail = 10 unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 1 vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { process_limit = 256 } ssl_cert = </etc/ssl/XXXX ssl_cipher_list = DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:+TLSv1:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!PSK:!SRP:!SSLv2:!3DES:!DSS ssl_key = </etc/ssl/XXXX ssl_parameters_regenerate = 128 hours userdb { args = blocking=no driver = passwd override_fields = home=/var/mail/%u mail=maildir:/var/mail/%u } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 64 } protocol pop3 { mail_max_userip_connections = 32 pop3_client_workarounds = oe-ns-eoh pop3_save_uidl = yes }

2 2

Re: [Dovecot] BUG report: doveadm HEADER <field> <pattern> when concatenating with another Search key
by Joseph Tam 09 Jan '14

09 Jan '14

> So E.g. When doing > doveadm fetch -u exampleuser hdr SUBJECT Silvester HEADER > Return-Path someuser(a)example.com > > it initially outputs 13 headers (same as when using with SUBJECT Silvester > only) , when piping it to "grep -i 'Return-Path'" it even found only 3 out > of 13 headers containing a Return-Path at all, 2 of them different than > someuser(a)example.com - so SAME behaviour as with search. I tried using logical conjections of header searches and it works with my installation of dovecot, so either it's a bug introduced later than 2.1.16, or perhaps it from the different search engine you use (I use the default that comes with dovecot -- squat?). Sorry, can't help you out further. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] Disallow certain characters in foldernames?
by Charles Marcus 08 Jan '14

08 Jan '14

Is there a way to do this in dovecot? Similar to how you can When using Maildir and Thunderbird, if a user tries to a create folder named "test.1" or "test/1", dovecot will happily create a folder called "test", with a subfolder called "1". Worse, the top level folder "test" is greyed out, which is how Thunderbird displays a folder that can contain only other folders, not both folders and files. I want to disallow this. Obviously I'd prefer if Thunderbird would display a meaningful error, but most likely dovecot cannot control that. I don't really care if the user just gets some kind of weird generic error or not, I'd just prefer to prevent dovecot from creating the problematic folders, and explain the problem to the user if/when they call about it (after NOT reading my carefully crafted documentation explaining the illegal characters that cannot be used in foldernames). -- Best regards, Charles

2 3

[Dovecot] acl, shared folders
by Infoomatic 08 Jan '14

08 Jan '14

Hi list, After spending quite some time to figure out how users can share folders I now hope someone of you could help me out. I am quite sure its just a stupid mistake/misunderstanding ... I am using Ubuntu 12.04 LTS with the shipped dovecot 2.0.19 When I login via telnet as user1 I get the following: 1 create folder1 1 OK Create completed. 2 setacl folder1 user2 rli 2 OK Setacl complete. 3 getacl folder1 * ACL "folder1" "user2" ilr "user1" lrwstipekxacd 3 OK Getacl completed. This seems fine. However, there is nothing listed in the account of user2. I think the mistake is in the namespace configuration of "location" or "prefix" Please help! Thanks! infoomatic # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-45-generic x86_64 Ubuntu 12.04.3 LTS ext4 auth_username_format = %n disable_plaintext_auth = no mail_debug = yes mail_gid = vmail mail_home = /var/lib/vmail/home/%u mail_location = mdbox:/var/lib/vmail/mail/%u mail_plugins = " acl zlib fts fts_solr acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave imapflags mdbox_rotate_size = 64 M namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = mdbox:/var/lib/vmail/mail/%%n/mailboxes/shared/%n prefix = shared/%%n/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/vmail/shared-mailboxes fts = solr fts_solr = break-imap-search url=http://localhost:8080/solr/ sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +imapflags zlib_save = bz2 zlib_save_level = 6 } protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail user = vmail } } service managesieve-login { inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = " sieve acl" } protocol imap { mail_plugins = " acl imap_acl" }

2 2

[Dovecot] Dovecot deliver into folder question
by Marc Perkel 08 Jan '14

08 Jan '14

If I want to user dovecot deliver into a folder that is not at the root level - how do I do that? How do I specify a folder in a folder?

4 7

[Dovecot] LMTP with virtual and system users
by Philipp Kolmann 08 Jan '14

08 Jan '14

Hi, I have a mailsystem where i have some local users with shell access and full home dirs which receive mail and also several SQL virtual users only for mail. With the virtual users, everything works fine. Mail is delivered via LMTP and also sieve works :) The SQL Lookup knows what to do with username(a)domain.com The problem is the system user. If exim delivers the mail to the lmtp socket, the LMTPd can't find username(a)local.host I would be able to specify the global auth_username_format=%n but then my SQL queries break and I like the possibility to have xx(a)domain1.com and xx(a)domain2.com routed to two different accounts. As I have seen in the source, I can't specify username_format=%n in the passdb { driver = pam } backend. Do you have any suggestion how to solve this issue? thanks Philipp

3 6