October 2014 - dovecot

Disabling SSLv3 protocol
by Timo Sirainen 12 Nov '14

12 Nov '14

Since people are now talking about the SSLv3 security hole and how to disable it, here's a thread where you can talk about that. In Dovecot v2.1+ you can disable SSLv3 by setting: ssl_protocols = !SSLv2 !SSLv3 In older versions you'd have to patch the source code. Attached a patch against v2.0. I don't know if there are any clients that would break by disabling SSLv3. I'd expect all the clients to use the system (or otherwise generic) SSL libraries, which would automatically choose the TLS protocol over SSL. So my guess is that unless somebody is using over a 10 year old client there wouldn't be any problems. Maybe some old mobile phones might be using SSL.. If you find out about any clients that require SSLv3 I'd like to know about it. For Dovecot v2.3 I could maybe disable SSLv3 by default if there's no real need for it. (Also: Don't be confused by SSL/TLS protocols vs. SSL port/STARTTLS, as described in http://wiki2.dovecot.org/SSL. For example https://en.wikipedia.org/wiki/Comparison_of_email_clients#SSL_and_TLS_suppo… is irrelevant here.)

3 4

Public mailbox confusion
by Stefan G. Weichinger 05 Nov '14

05 Nov '14

greets, I am quite sure I ask some faq here ... sorry, but I am confused by the many options and choices here. What I want to do is: I migrate lots of public folders from a MS Exchange Server ... The customer wants that there is a "Public" folder containing all these hundreds of folders, the public folder should be visible for all the dovecot-users and all the subfolders should be automatically subscribed as soon a new user logs in. What I have now: namespace { type = private separator = / prefix = inbox = yes } namespace { type = public separator = / prefix = Public/ location = maildir:/home/vmail/public:INDEXPVT=/home/vmail/public/index/%d/%u/index subscriptions = yes } As far as I see from testing this doesn't yet work that way. When I open the mailbox with eg. roundcube I see "Public" but nothing below it ... Could someone please give me a good pointer here? Thanks! Stefan

2 4

Released Pigeonhole v0.4.5 for Dovecot v2.2.15.
by Stephan Bosch 01 Nov '14

01 Nov '14

Hello Dovecot users, Unfortunately, Pigeonhole v0.4.4 had a rather big issue with error handling and the execution of the implicit keep. This problem presented itself for example when users exceeded their quota. This did not result in the proper rejection message. This is why I quickly release a new version. Changelog v0.4.5: + Added a Pigeonhole version banner to doveconf output. This way, future bug reports will also include Pigeonhole version information. - Fixed handling of implicit keep. Last version erroneously reported that implicit keep succeeded after an earlier failure, while it in fact had failed. Particularly occurred for mailbox quota errors. - Fixed segfault occurring on SunOS systems when there is no active script. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.5.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.5.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

4 4

Corrupted SSL parameters file in state_dir with HG 267bca7a62fb
by Thomas Leuxner 01 Nov '14

01 Nov '14

Hi, with the latest HG 267bca7a62fb the following error started to appear in the logs: Oct 31 09:39:07 nihlus dovecot: master: Dovecot v2.2.15 (267bca7a62fb) starting up for imap, lmtp [...] Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Error: Couldn't initialize SSL parameters, disabling SSL Oct 31 10:10:52 nihlus dovecot: lmtp(20876): Connect from local This most likely has been introduced with a commit after the previous build installed (aa5dde56424f). I did not find options to disable SSL for LMTP either, as in my setup I'm using a UNIX socket. Regards Thomas

4 4

authentication issues with ipad / mac email client
by Rajesh M. 01 Nov '14

01 Nov '14

hi we are using using qmail toaster with dovecot pop3 and imap client outlook and thunderbird works fine in case of several ipad / mac email clients imap works fine but pop3 logins are not working with 110 port my dovecot config file is given below could somebody help please # Settings for 'stock' qmail-toaster disable_plaintext_auth = no default_login_user = vpopmail mail_max_userip_connections = 50 service imap-login { service_count = 0 client_limit = 256 process_min_avail = 4 vsz_limit = 384M process_limit = 400 } auth_cache_size = 32M auth_cache_ttl = 1800 auth_cache_negative_ttl = 0 auth_mechanisms = plain login digest-md5 cram-md5 auth_username_format = %Lu first_valid_uid = 89 first_valid_gid = 89 log_path = /var/log/dovecot.log login_greeting = ready. mail_plugins = $mail_plugins quota plugin/quota = maildir protocols = imap pop3 ssl_cert = </var/qmail/control/servercert.pem ssl_key = </var/qmail/control/servercert.pem # the following will likely be the default at some point ssl_dh_parameters_length = 2048 namespace { inbox = yes location = prefix = # prefix = INBOX. # Use 'prefix = INBOX.' for Courier-IMAP compatible transparent migration. # This forces all client apps to create subfolders underneath/within # the inbox instead of adjacent to it. It's not necessary to be that way. # FWIW, shubes thinks this setting is annoying/rediculous/retarded. # As a practical example, having no prefix allows mobile users to select # which folders get synchronized. Otherwise their whole mailbox is # synchronized, and they have no way to choose which folders they want sync'd. separator = . type = private } passdb { args = cache_key=%u webmail=127.0.0.1 driver = vpopmail } protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = $mail_plugins imap_quota } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_lock_session = no # pop3_uidl_format = UID%u-%v pop3_no_flag_updates=yes } userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } plugin { quota = maildir:ignore=Trash quota_rule = ?:storage=0 } thank you very much, rajesh

3 2

SSLv3 attack on pop3?
by Hans Morten Kind 31 Oct '14

31 Oct '14

We turned off SSLv3 support on our pop/imap running dovecot on Oct 16th, we did check that all users where using TLSv1 and there have been no complaints (except one old windows-phone). But at 13:00 UTC today, suddenly strange entries is seen in the logfile: Error: SSL: Stacked error: error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message: SSL alert number 10 Followed by: pop3-login: Disconnected (no auth attempts in 2 secs) user=<>, rip= Some 20 ips have been seen so far, all ips are uniq and none have used our server lately. Just one resoved and it's name ends .cn, some lookups with whois leads to the same origin for all. This makes me anxious that some have made some poodle-like thing for pop3? hmk

2 2

vpopmail, open_smtp_relay and non-PLAIN auth mechs
by Jim Jagielski 31 Oct '14

31 Oct '14

I've noticed that if using the vpopmail auth setup, that the roaming-user functionality provided via open_smtp_relay() is only done if the auth mechanism is PLAIN. For example, if the client authenticates via DIGEST-MD5, the open relay file is not updated, as it should be. This is due to the call to open_smtp_relay only being done via vpopmail_verify_plain(). Instead, imo, that call should be done in auth_request_success() in the auth-request.c file, so that it is done however the authentication is done, as long as it is successful. Attached is a patch for 2.2.15. Let me know if attachments are not the preferred method and I'll cut/paste. tia! -- Jim Jagielski

2 2

Can someone explain this Sent thread sorting?
by Philip Rhoades 31 Oct '14

31 Oct '14

People, I attach a screen capture of my RoundCubeMail Sent box - why does the second item on the list, which is a separate reply to the thread above it, get sorted to position 2? By the date, and being a single mail, it should be much further down the screen . . I presume it is because the Subject is the same? Thanks, Phil. -- Philip Rhoades GPO Box 3411 Sydney NSW 2001 Australia E-mail: phil(a)pricom.com.au

2 1

Question wrt. dovecot replicator
by Remko Lodder 30 Oct '14

30 Oct '14

Hi People, I recently setup a replication service within dovecot between two machines in different datacenters, which has the following configuration; (yes it is hashed out, because I needed to) #service replicator { # unix_listener replicator-doveadm { # mode = 0666 # } # process_min_avail = 1 #} # #service aggregator { # fifo_listener replication-notify-fifo { # mode = 0666 # #user = vmail # } # unix_listener replication-notify { # mode = 0666 # #user = vmail # } #} # #service doveadm { # inet_listener { # port = 12346 # } #} # ##doveadm_port = 12346 #doveadm_password = XXXXXXX #replication_max_conns = 30 # and a mail_replica = tcp:host{a,b}:12346 configuration on each host so that they are pointing to eachother; This seems to work fine for most accounts, for example: I never experienced issues with this. However, several other accounts (with a large variety of clients) got duplicated emails. Looking with doveadm I only noticed that the numbers of the messages are closely related to eachother but one number incremented. So they cannot be deleted with the deduplicator function. The replication is provided over TCP only, the connection streams over an OpenVPN tunnel so that the contents are protected, the machines are located in different Datacenters but close to eachother. How can I determine why there are duplicated emails? What kind of messages should I specifically look for? Can I set this up for a few selected accounts instead of all accounts like it was currently? To make sure I do not make things worse for others then needs to be :-) The service had been disabled for the time being to prevent the other users from getting duplicated emails. Thanks for the advice in advance! Cheers Remko -- /"\ Best regards, | remko(a)FreeBSD.org \ / Remko Lodder | remko@EFnet X http://www.evilcoder.org/ | / \ ASCII Ribbon Campaign | Against HTML Mail and News

3 6

different mail location in different namespace
by Héctor Moreno Blanco 30 Oct '14

30 Oct '14

Hello everyone, We have Dovecot 2.1.6. With different Namespaces: ... mail_location = maildir:%h/Maildir ... namespace { separator = . prefix = inbox = yes type = private } namespace { inbox = no location = prefix = INBOX. separator = . hidden = yes type = private list = no } namespace { location = maildir:/buzon/archivo/%u/_ARCHIVO prefix = _ARCHIVO. hidden = yes separator = . type = private } We take the attribute "home directory" from the LDAP in the userdb attributes. We would like to modify this attribute for the Namespace ARCHIVO. For example, if a home directory is /buzon/buzon1/11111111, the mail location for ARCHIVO would be /buzon/archivo1/11111111. Is this modification possible without adding another attribute at the LDAP (just editing the attribute)? Thank you very much in advanced. Kind regards. Héctor Moreno. P Please consider the environment before printing this e-mail. ______________________ This message including any attachments may contain confidential information, according to our Information Security Management System, and intended solely for a specific individual to whom they are addressed. Any unauthorised copy, disclosure or distribution of this message is strictly forbidden. If you have received this transmission in error, please notify the sender immediately and delete it. ______________________ Este mensaje, y en su caso, cualquier fichero anexo al mismo, puede contener informacion clasificada por su emisor como confidencial en el marco de su Sistema de Gestion de Seguridad de la Informacion siendo para uso exclusivo del destinatario, quedando prohibida su divulgacion copia o distribucion a terceros sin la autorizacion expresa del remitente. Si Vd. ha recibido este mensaje erroneamente, se ruega lo notifique al remitente y proceda a su borrado. Gracias por su colaboracion. ______________________

2 4