January 2015 - dovecot

Dovecot & gethostbyname() vulnerability
by Timo Sirainen 28 Jan '15

28 Jan '15

So just a quick note: Dovecot in general doesn't do DNS lookups, except the ones in configuration files and such. So I don't think there are any Dovecot setups which do DNS lookups for untrusted hostnames. Also, gethostbyname() is used only if IPv6 support isn't compiled into Dovecot. And IPv6 support is enabled by default if the libc is detected to support it, so pretty much all systems use it.

1 0

Uniqueness of dovecot mailbox-guids
by Christian Binder Stadt Freilassing 28 Jan '15

28 Jan '15

Dovecot version: 2.2.9 I'm using doveadm backup to migrate about hundred user mailboxes from cyrus to dovecot. I defined a master user for the old cyrus mailserver in imapc backend to get access to all the mailboxes. Now I realized that after migration every user's "Inbox" or "Trash" on the new dovecot server has the same mailbox-guid, e.g: User a: inbox dd9456... trash 5549cc... User b: inbox dd9456... trash 5549cc... Is this a wanted behaviour? If i do not migrate with doveadm backup and just manually create mailboxes, the mailbox-guids are globally unique, e.g: User a: inbox dd9456... trash 5549cc... User b: inbox c543fe... trash t49ccc... Thanks! Christian

1 0

dovecot migration
by mkawada＠redhat.com 28 Jan '15

28 Jan '15

Dear List, To migrate a dovecot server from dovecot-1.x to dovecot-2.x, then I wonder if the UIDL format "pop3_uidl_format" setting is required in the configuration file for clients not to re-download the same mails from the migrated mail server. Currently, no UIDL format is set in /etc/dovecot file of the one using dovecot-1.x server which means it is commented out as default like below. ]# grep pop3_uidl_format /etc/dovecot.conf #pop3_uidl_format = %08Xu%08Xv <---- Does this mean the "pop3_uidl_format" is in use as "%08Xu%08Xv" by default? I see the same in /etc/dovecot/conf.d/20-imap.conf of the one using dovecot-2.x, and have not been able to find any information saying it's the defualt setting. Here are the questions: 1.Can we say the "pop3_uidl_format = %08Xu%08Xv" is the enabled default setting? Or any ways to check the default? 2.Do they need to specify anything for the "pop3_uidl_format =" field for their migration in this case? Env infomation: dovecot-1.x dovecot-2.x mail_location = mbox Any information/clues would be greatly appreciated. Thanks,

3 4

sendmail not invoking dovecot-lda
by alvin 27 Jan '15

27 Jan '15

hi dovecot mailinglist - Configuration FreeBSD-9.3 sendmail -d0.1 == sendmail-8.14.9 <<-- dovecot --version == dovecot-2.2.15 # =================================================================== # I'm trying to get sendmail to invoke dovecot.m4 ( dovecot-lda ) to # deliver emails to dovecot's virtual users ( /etc/dovecot/passwd ) # or mysql/postgresql virtual users # # # sendmail -bv dovecot.VirtualUser@localhost --> returns "User Unknown" # # cat test.msg.txt | dovecot-lda -d dovecot.VirtualUser ===> works # email is delivered to dovecot.VirtualUser inbox # # =================================================================== - there are tons of howto and comments for dovecot + postfix and very little for dovecot + sendmail ... therefore, it'd be great if we/i can get this dovecot.m4 problem resolved ------------------------------------------------------------------------------ - status of what works and what does NOT work while testing dovecot's LDA ... ------------------------------------------------------------------------------ # # fyi.. recepient user is in the form of user, user@localhost and user(a)domain.com # sendmail -bv user.in/etc/passwd = deliverable sendmail -bv user.in/etc/mail/virtusertable = deliverable to sendmail virtual user -->> sendmail -bv dovecot.user.in/dovecot/virtual.passwd.file == user unknown dovecot user user.in/etc/passwd == returns UID/GID/home/mailbox ( deliverable ) dovecot user dovecot.user == returns UID/GID/home/mailbox ( deliverable ) # -------------------------------------------------------------------- # dovecot's LDA delivers the test email to the dovecot/mysql recepient # -------------------------------------------------------------------- cat test-email-with-headers.txt | dovecot-lda -d dovecot.user ( email delivered ) # ---------------------------------------------------------------- -->> # mail/mutt/sendmail canNOT deliver to dovecot recepient == FAILS # ---------------------------------------------------------------- -->> sendmail -bv dovecot.user.in/dovecot/virtual.passwd.file == user unknown 3 echo "testing mail to dovecot" | mail -v -s "testing mail to dovecot" doveccot.user == user unknown == ------------------------------------------------------- - my (relevant to dovecot ) sendmail.mc file looks like: ------------------------------------------------------- dnl # dnl # local mail delivery dnl # define(`PROCMAIL_MAILER_PATH', `/usr/local/bin/procmail')dnl FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl dnl # dnl # I'm trying to get sendmail to use dovecot.m4 to deliver local mail dnl # to dovecot's LDA ( dovecot-lda ) for mysql virtual users dnl # dnl uncomment and use either feature(...dovecot-lda) or mailer(dovecot.m4) dnl dnl FEATURE(`local_procmail', `/usr/local/libexec/dovecot/dovecot-lda',`/usr/local/libexec/dovecot/dovecot-lda -d $u') dnl MAILER(local) MAILER(smtp) dnl dnl MAILER(dovecot)dnl # did NOT work either dnl dnl # trying to use procmail to deliver local mail to system users ( /etc/passwd ) MAILER(procmail) dnl dnl # is the ordering of dovecot.m4 important relative to (local) and (procmail) dnl dnl # trying to use dovecot-lda to deliver email to dovecot's virtual users dnl # defined in /etc/dovecot/password dnl MAILER(dovecot)dnl # see below dnl dnl End of File ------------------------------------------------------- - my (relevant to dovecot ) sendmail.cf file looks like: ------------------------------------------------------- # # lots of deleted ... ??not?? important until Mlocal ---> MAILER(local) # Mlocal, P=/usr/libexec/mail.local, F=lsDFMAw5:/|@qPSXmnz9, S=EnvFromSMTP/HdrFromL, R=EnvToL/ HdrToL, T=DNS/RFC822/SMTP, A=mail.local -l Mprog, P=/bin/sh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/, T=X-Unix/X-Unix/X-Unix, A=sh -c $u ##################################### ### SMTP Mailer specification ### ##################################### # # lots of deleted ... ??not?? important until procmail stuff ---> MAILER(procmail) # ######################*****############## ### PROCMAIL Mailer specification ### ##################*****################## ##### $Id: procmail.m4,v 8.23 2013-11-22 20:51:14 ca Exp $ ##### Mprocmail, P=/usr/local/bin/procmail, F=DFMSPhnu9, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFr omSMTP, T=DNS/RFC822/X-Unix, A=procmail -Y -m $h $f $u ######################*****######################### ### ### ### 10-Jan-15 amo Dovecot.m4 ### ### ### ### dovecot.m4 stuff ### ### ### ##############################*****################# Mdovecot, P=/usr/local/libexec/dovecot/dovecot-lda, F=DFMPhnu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, T=DNS/RFC822/X-Unix, A=/usr/local/libexec/dovecot/dovecot-lda -d $u # # End of sendmail.cf ===================================================================== - dovecot has an example dovecot.m4 ... but it doesn't allow sendmail to call dovecot to deliver local mail with dovecot-lda ===================================================================== http://wiki2.dovecot.org/LDA/Sendmail ######################################### ### DOVECOT Mailer specification ### ######################################### # # # dovecot virtual users defined in: /etc/dovecot/password # # # # cp /etc/mail/dovecot.m4 /usr/share/sendmail/cf/mailer # # # # cd /etc/mail && make # # /etc/rc.d/sendmail restart # # # # the dovecot.m4 stanza are in the resulting sendmail.cf # # # ######################################### Mdovecot, P=/usr/local/libexec/dovecot/dovecot-lda, F=DFMPhnu9, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, T=DNS/RFC822/X-Unix, A=/usr/local/libexec/dovecot/dovecot-lda -d $u # # i've tried using these other options in lieu of the above : # # F=DFMPShnu9 # added "S" option # F=lsDFMAw5:/|@qSPfhn9, # # S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, # # # # tried adding U= between S= and T= lines # U=root:mail U=dovecot:mail U=dovenull:mail # # End of dovecot.m4 http://wiki2.dovecot.org/LDA/Sendmail also states that one could use these 3 statements in lieu of dovecot.m4 # # this replaces sendmail.cf Mlocal P=mail.local with P=dovecot-lda # FEATURE(`local_procmail', `/usr/local/libexec/dovecot/dovecot-lda', \ `/usr/local/libexec/dovecot/dovecot-lda -d $u') dnl MODIFY_MAILER_FLAGS(`LOCAL', `-f') MAILER(procmail) vi /etc/mail/mailertable # # cd /etc/mail && make && /etc/rc.d/sendmail restart # # make and restart sendmail after editing # virtualdomain.example.com vmail:vmail # other options where sendmail still wasn't able to execute dovecot-lda # virtualdomain.example.com dovecot:local # virtualdomain.example.com local:mail # virtualdomain.example.com root:mail ------------------------------------ - my relevant dovecot config options ------------------------------------ # # are there any other major options i'm missing in the dovecot config files # doveconf dovecot -a # # for /etc/passwd passdb { args = driver = pam .. } # # ------------------------------------------------------------------------ # need to get these dovecot's virtual users to be able send/receive emails # ------------------------------------------------------------------------ # sendmail -bv dovecot.VirtualUser@localhost # dovecot.VirtuaUser@localhost... User unknown # passdb { args = /etc/dovecot/passwd # # dovecot.VirtualUser:{PLAIN}password::::: # # end of file driver = passwd-file .. } # passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql .. } ... ... ... userdb { args = driver = passwd .. } # userdb { args = /etc/dovecot/password driver = passwd-file .. } # userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql .. } # # --------------------------------------------------------------------- # -- How do i get sendmail to execute dovecot-lda for incoming emails # -- directed to dovecot virtual users and/or mysql users ?? # --------------------------------------------------------------------- # # end of txt

2 2

How to quote the special wildcard characters '*' and '?'
by David Davidov 27 Jan '15

27 Jan '15

Hello, I am searching for a way to execute doveadm command against mailbox containing a special wildcard character in its name. For example: # doveadm expunge -u 'me?(a)example.com' mailbox 'INBOX.Junk Mail' SAVEDBEFORE 7 The result is: doveadm(root): Error: User listing returned failure doveadm: Error: Failed to iterate through some users with exit code 75 In the mail log: dovecot: auth: Error: Trying to iterate users, but userdbs don't support it To be clear: the question mark is a part of the mailbox's name. Not an attempt to use it as wildcard. Is there a way 1. To quote the special characters or 2. To disable wildcard matcing in the -u parameter regards, -- David Davidov | System Administrator | ICDSoft Ltd.

2 1

"error: number of redirect actions exceeds policy limit"
by Kai Sommer 27 Jan '15

27 Jan '15

Greetings, after testing a lot with my system I have to write to this list to ask for help from the cummunity. My system: * Ubuntu 12.04.5 LTS * Dovecot 2.0.19 * Dovecot config (extract) ––––– 8< ––––– plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_max_redirects = 10 } ––––– >8–––––– * Sieve filter rules ––––– 8< ––––– require ["copy"]; # rule:[Alles weiterleiten] if true { redirect "mail_1@mydomain"; redirect "mail_2@mydomain"; redirect "mail_3@mydomain"; redirect "mail_4@mydomain"; redirect "mail_5@mydomain"; redirect "mail_6@mydomain"; keep; stop; } ––––– >8–––––– Problem scenario: With the redirect-filter (see above) Dovecot redirects a incoming email to the first address and stops withe the message "error: number of redirect actions exceeds policy limit" (.dovecot.sieve.log). In my mail.log I see the message "Error: sieve: execution of script $PATH/.dovecot.sieve failed, but implicit keep was successful (user logfile $PATH/.dovecot.sieve.log may reveal additional details)". If I reduce the count of recipients to four – which is the Dovecot default number – everything will redireced as expected. I only could find an old problem report here [0] where as the posted solution doesn't work for me (as you can see above). (Also I tried the rule "redirect :copy" that doesn't changed something …) [0] <http://dovecot.org/pipermail/dovecot/2012-August/085038.html> → Is this problem known? – Is there a solution for that problem? Thanks a lot and best regards! – Kai -- Kai Sommer sig: 5E2E FA58 43BD 5599 4068 | pubkey: http://ma.ximi.se/mekey

2 1

Thunderbird: improper command pipelining after EHLO
by Leander Schäfer 27 Jan '15

27 Jan '15

I couldn't find working solutions for this anomalie on the net. What does this mean and does someone know how to fix this? postfix/smtpd[18757]: improper command pipelining after EHLO from unknown[192.168.10.233]: QUIT\r\n Thanks Best Regards, Leander

4 4

imap-login: Fatal: pipe() failed: Too many open files
by Leander Schäfer 26 Jan '15

26 Jan '15

Hi I keep on getting errors and can't connect/login to Dovecot. I did my research but unfortunately without success. It is for sure not ulimit because ulimit is set to unlimited per default already. Still , it complains about "Too many open files" but this is a test system and the service dovecot and postfix have just been started. No one except me is testing on this system. This is very weired ;/ root@WM-01 [~]$ service dovecot stop; service postfix stop ; echo "" > /var/log/maillog ; echo "" > /var/log/slapd.log ; service postfix start ; service dovecot start Stopping dovecot. Waiting for PIDS: 3245. postfix/postfix-script: stopping the Postfix mail system postfix/postfix-script: starting the Postfix mail system Starting dovecot. root@WM-01 [~]$ telnet 127.0.0.1 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. root@WM-01 [~]$ cat /var/log/mail Jan 26 01:39:12 WM-01 dovecot: imap-login: Fatal: pipe() failed: Too many open files Jan 26 01:39:12 WM-01 dovecot: master: Error: service(imap-login): command startup failed, throttling for 4 secs If I uncoment port = 0 in POP and IMAP then it looks even worse then above. Telnet is not even closed by remote host and three of the "Too many open files" errors are showing up in maillog: root@WM-01 [~]$ telnet 127.0.0.1 143 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. ^] telnet> Connection closed. root@WM-01 [~]$ cat /var/log/maillog Jan 26 01:45:19 WM-01 postfix/postfix-script[60560]: starting the Postfix mail system Jan 26 01:45:19 WM-01 postfix/master[60562]: daemon started -- version 1.0, configuration /usr/local/etc/postfix Jan 26 01:45:19 WM-01 dovecot: master: Dovecot v2.2.15 starting up for imap, pop3, lmtp Jan 26 01:45:24 WM-01 dovecot: imap-login: Error: socket(login) failed: Too many open files Jan 26 01:45:24 WM-01 dovecot: imap-login: Error: auth: connect(login) failed: Too many open files Jan 26 01:45:24 WM-01 dovecot: imap-login: Error: net_accept() failed: Too many open files root@WM-01 [~]$ Does anyone have an idea what could be wrong here? I attached the relevant configuration below. I use OpenLDAP as backend. Please let me know if you need more information. Thank you very much. Best Regards, Leander # ========================== dovecot -n ============================== # # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: FreeBSD 10.1-RELEASE amd64 ufs auth_debug = yes auth_debug_passwords = yes auth_failure_delay = 3 secs auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes base_dir = /var/run/dovecot/ disable_plaintext_auth = no imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = Welcome to Mail Server. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/%d/%n mail_plugins = quota expire mail_log notify mail_privileged_group = mail mail_temp_dir = /tmp/Dovecot mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { expire = Trash mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_rule = *:storage=1G quota_rule2 = Trash:storage=+30%% quota_rule3 = Sent:storage=+30%% quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = info(a)netocean.de sendmail_path = /usr/local/sbin/sendmail service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imaps { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service pop3-login { inet_listener pop3s { port = 0 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = required ssl_cert = </etc/ssl/RootCA/certs/192.168.50.101.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA ssl_key = </etc/ssl/RootCA/certs/192.168.50.101.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_ssl = yes protocol lda { mail_plugins = sieve } protocol imap { mail_max_userip_connections = 3 mail_plugins = imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 3 } # ======================== dovecot/conf.d/auth-ldap.conf.ext =================== # passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext } # "prefetch" user database means that the passdb already provided the # needed information and there's no need to do a separate userdb lookup. # <doc/wiki/UserDatabase.Prefetch.txt> userdb { driver = prefetch } userdb { driver = ldap args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext # Default fields can be used to specify defaults that LDAP may override #default_fields = home=/home/virtual/%u } # ======================== dovecot/dovecot-ldap.conf.ext =================== # hosts = 127.0.0.1:389 dn = uid=dovecot,ou=systemuser,ou=mail,dc=MyDomain,dc=TLD dnpass = TopSecret tls = yes tls_cert_file = /etc/ssl/RootCA/certs/192.168.50.101.pem tls_key_file = /etc/ssl/RootCA/certs/192.168.50.101.key debug_level = -1 auth_bind = yes ldap_version = 3 base = ou=accounts,ou=mail,dc=MyDomain,dc=TLD scope = subtree user_attrs = mailStorageDirectory=home, mailUidNumber=uid, mailGidNumber=gid, mailQuotaSize=quota_rule=*:bytes=%$, mailQuotaCount=quota_rule2 user_filter = (&(objectClass=mailAccount)(mailAddress=%u)) pass_attrs = mailAddress=user,mailPassword=password pass_filter = (&(objectClass=mailAccount)(mailAccountStatus=active)(mailAddress=%u)) default_pass_scheme = SSHA

3 8

Re: LDA input validation
by Joseph Tam 26 Jan '15

26 Jan '15

St?phane Cottin writes: >> You're stilling going to lose contents. If dspam fails, the mail >> is dumped, the LDA returns exit code 75, and the MTA will probably >> issue a bounce Email to the sender. > > from dovecot-lda man page : > > 75 A temporary failure. This is returned for almost all failures. See the log file for > details. (EX_TEMPFAIL) > > The mta keep the mail and retry delivery later, which is what I need. Ah, my mistake. But ... > I don't want to deliver email on dspam error, I prefer TEMPFAIL and > future retries, so I have a chance to fix the issue later without > loosing or deliver unprocessed mails ... you only have a limited time to fix it. Depending on the sending MTA's retry schedule, you might have only a few days or less to to deal with it before the sending MTA stops trying. If it's important not to lose mail, then the deliver on failure strategy would be more appropriate. You can even copy the input message that caused dpam to crash to an inspection queue for later perusal. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: LDA input validation
by Joseph Tam 26 Jan '15

26 Jan '15

St?phane Cottin writes: > dspam already send errors to syslog, the point here is to never loose > email contents. This was a wrong design, i'm now use a wrapper instead > ( see my previous post for details ). You're stilling going to lose contents. If dspam fails, the mail is dumped, the LDA returns exit code 75, and the MTA will probably issue a bounce Email to the sender. If you really don't want the recipient to lose Email, you should buffer the input into a file, run dspam on it, and if the output is not-null, pipe it to dovecot-lda, otherwise pipe the original input. Joseph Tam <jtam.home(a)gmail.com>

4 6