April 2024 - dovecot - dovecot.org

Is it possible to setup ntlm authentication then proxy it to the mail server ?
by karl.l＠as7600.net 26 Apr '24

26 Apr '24

Hi, This is my dovecot version: ``` root@freebsdsvr:~ # dovecot --version 2.3.21 (47349e2482) ``` I'm having trouble in making dovecot as proxy to the mail server when using ntlm authentication. My setup looks like this: email client ------> dovecot (will act as proxy) -------> mail server so basically the email client will connect to dovecot but dovecot will forward it to the mail server. Proxying using auth_mechanism as PLAIN is working but if I use ntlm authentication it just connects into the dovecot server and dovecot server does not proxy to to the mail server. I tried using passdb driver = sql, passdb driver = static, passdb driver = lua and all of them are working when the email client connects using plain auth, once dovecot authenticates the user it will proxy it to the mail server but when I use ntlm authentication it just connects to dovecot and does not do a proxy to the mail server. I switched on all the debugs and I found out in the log that when I connect using PLAIN auth it calls the passdb and gets my default_fields or my proxy fields ```proxy=y``` and ```host=mailserver_domain``` which causes dovecot to proxy into the host(my mail server). but when I connect using NTLM auth it calls the passdb but it does not return my default fields for proxying (when it uses the sql passdb driver it just connects to the database and does not run the password_query) and I think it uses the output from the ```ntlm_auth``` of samba that dovecot uses because it retunrs the field user=username and original_user=username@domain This is the example logs that I recieved once I connect using ntlm and it does not proxy it to my mail server ``` Apr 18 03:37:29 freebsdsvr dovecot[12084]: auth: Debug: mysql(192.168.254.131): Connecting Apr 18 03:37:29 freebsdsvr dovecot[12084]: auth: Debug: auth client connected (pid=12268) Apr 18 03:37:29 freebsdsvr dovecot[12084]: auth: Debug: auth client connected (pid=12270) Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client in: AUTH 1 NTLM service=imap session=Js8TT04WcMnAqP5/ lip=192.168.254.131 rip=192.168.254.127 lport=143 rport=51568 Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client passdb out: CONT 1 Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client in: CONT 1 TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA= (previous base64 data may contain sensitive data) Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client passdb out: CONT 1 TlRMTVNTUAACAAAAFAAUADgAAAAFgooC57WwKq2q4U8sdAAAAAAAAAAFwAXABMAAAABgEAAAasdasdasdAAAA9FAFMAQwAuAE4ARQBUAC4AQQBVAAIAFABFAFMAQwAuAE4ARQBUACad4AQdsQBVAAEasAFABFAFMAQwAuAE4AdaRQBUAC4AQQBVAAQAAAADABQAZQBzAGMALgBuAGUAdAAuAGEAdQAHAAgA/h8T7O2Q2gEAAAAA Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client in: CONT 1 TlRMTVNTUAADAAAAGAAYAFwAAACIAIgAdAAAAAAAAeABAAAAABgAGAEAAAAAWABYARgAAAAAAAAAAAAAABYIIAHMAcwAzAFcATwBSAEsAUwBUAEEAVABJAE8ATgBXKrBA2vF7fMicRiasLK/IyI3fbM46rQ7JHcti/0TU02AqasdasdasdhceI+BaeqMjrAQEAAAAAAACAL88ampDaARzhirKymxxcAAAAAAIAFABFAFMAQwAuAE4ARQBUAC4AQQBVAAEAFABFAFMAQwAuAE4ARQBUAC4AQQBVAAQAAAADABQAZQBzAGMALgBuAGUAdAAuAGEAdQAHAAgA/h8T7O2Q2gEAAAAA (previous base64 data may contain sensitive data) Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: auth(userName,192.168.254.127,<Js8TT04WcMnAqP5/>): Auth request finished Apr 18 03:37:30 freebsdsvr dovecot[12084]: auth: Debug: client passdb out: OK 1 user=userName original_user=userName@FREEBSD-TEST ``` Here's the logs that I get when I connect via Plain Auth and it does the proxy to my mail server ``` Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: mysql(192.168.254.131): Connecting Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): Server accepted connection (fd=15) Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): Sending version handshake Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): auth-worker<1>: Handling PASSV request Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): auth-worker<1>: sql(ss3,192.168.254.127,<zwTdK04W9MbAqP5/>): Performing passdb lookup Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): auth-worker<1>: sql(ss3,192.168.254.127,<zwTdK04W9MbAqP5/>): query: SELECT destuser, password, host, 'Y' as proxy FROM proxy WHERE user = 'userName'; Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: mysql(192.168.254.131): Finished query 'SELECT destuser, password, host, 'Y' as proxy FROM proxy WHERE user = 'userName';' in 0 msecs Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): auth-worker<1>: sql(userName,192.168.254.127,<zwTdK04W9MbAqP5/>): Finished passdb lookup Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth-worker(12138): Debug: conn unix:auth-worker (uid=0): auth-worker<1>: Finished Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: sql(userName,192.168.254.127,<zwTdK04W9MbAqP5/>): Finished passdb lookup Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: auth(userName,192.168.254.127,<zwTdK04W9MbAqP5/>): Auth request finished Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: conn unix:dns-client: dns(mailserver.domain): Lookup started Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: conn unix:dns-client: Connecting Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: conn unix:dns-client (uid=0): Client connected (fd=27) Apr 18 03:27:39 freebsdsvr dovecot[12084]: auth: Debug: conn unix:dns-client (uid=0): Sending version handshake Apr 18 03:27:40 freebsdsvr dovecot[12084]: auth: Debug: conn unix:dns-client (uid=0): dns(mailserver.domain): Lookup successful after 658 msecs Apr 18 03:27:40 freebsdsvr dovecot[12084]: auth: Debug: client passdb out: OK 1 user=userName destuser=userName host=mailserver.domain proxy hostip=mailserverip pass=password ``` Is there a right way to configure ntlm to do proxy? because it does not seem to use the passdb in sql,lua, and static drivers. This is my dovecot -n ``` root@freebsdsvr:~ # dovecot -n # 2.3.21 (47349e2482): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 13.2-RELEASE amd64 zfs # Hostname: freebsdsvr auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login ntlm auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain auth_winbind_helper_path = /usr/local/bin/ntlm_auth disable_plaintext_auth = no mail_debug = yes mail_gid = 1001 mail_location = maildir:/var/mail/vhosts/%n mail_uid = 1001 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service auth { user = root } ssl_cert = </root/dovecot.crt ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_key = # hidden, use -P to show it passdb { driver = sql # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext args = /usr/local/etc/dovecot/dovecot-sql.conf.ext } userdb { driver = prefetch } ``` dovecot-sql.conf.ext ``` driver = mysql connect = host=192.168.254.134 port=3306 dbname=mails user=karl password=adminpassword password_query = SELECT destuser, password, host, 'Y' as proxy FROM proxy WHERE user = '%u'; ``` Thanks :)

5 6

using keycloak
by A. Schulze 25 Apr '24

25 Apr '24

Hello, I'm relative new to oauth2. I like to understand a setup for dovecot but https://doc.dovecot.org/configuration_manual/authentication/oauth2/ is not enough for me. Could anybody describe a simple setup where dovecot uses keycloak. For simplification I would start with keycloak's builtin user management only. - how to configure dovecot - how to configure keycloak - how to test with 'curl --verbose --some-magic-options imap://dovecot-server' Thanks, Andreas

1 0

Which DKIM application for postfix 3.9.0
by dovecot＠outputservices.com 25 Apr '24

25 Apr '24

I am upgrading to postfix 3.9.0. I have not used DKIM in previous postfix installs, but I would like to start now with the new google rules. I have done some research and opendkim is the most recommended, however, other research states the opendkim has been abandoned by it's maintainers. So I am looking for a good alternative dkim software that will work with postfix that I can compile myself. I do not run on any linux version, so therefore I can not just apt-get a new dkim application. I run Solaris and therefore need to compile my applications, postfix and dkim. Any good suggestions will be appreciated.

7 8

HELP with email attachments ONLY clean up
by INFO ＠ TRIMLINE 25 Apr '24

25 Apr '24

Hello Dovecot Dev team, In my cpanel, we use your email management. This is what my hosting provider has allowed. Our problem: Since the introduction of "hi def cameras on mobile phones", we are getting emails with "huge attachments". The email which comes with the attachments is also important. However, once we download the email (imap), using any of the email clients (outlook, bluemail etc.) the mailbox still has these huge attachments. Because of this, our mailbox storage gets filled up quickly. In our email client software, we can delete (attachments only), and leave the email in our mailbox. So this work around helps us keep our mailbox size manageable. Unfortunately, not everyone does this "email attachment cleanup" regularly and end up being locked out of email storage space and probably lost a few hours of productive time. Our dev Request: Would it be possible to create a setting for end users in our Cpanel, in which we can delete the attachments without deleting the actual message? So query should have: <per email mailbox account> (drop down selection, like you have it now) * Filter 01: Select Messages older than nnn days (where nnn would be 100 to 999 days) (so for the first 99 days, every imap client would have the opportunity to download the email and the attachments) * From Filter 01 = Filter 02: Select messages which are >xxx Mb (where xxx could be 001 to 999 Mb) * From Filter 02 = Filter 03: Select only messages which contain attachments (Yes) * From Filter 03: Permanently Delete the attachments ONLY, So not deleting the actual email msg (OK). So on day 100 (or after the clean up is done), the imap email client will now only get the email but not the attachments (in the event they need to refresh their email setup). If such a query can be created and installed on our Cpanel, we can run this "clean up attachments" query regularly and as such reduce our mailbox size. Q: Would it be possible to create such a clean up tool (pre-defined) so that the cpanel web service admin user only has to enter (nnn and xxx and Yes) to finally click on "OK" to delete the attachments? If this would be possible, what will it cost us to have it installed on our Cpanel? There is so much information/documentation already on your website (doc.dovecot.org) and I spent about 60 min looking for such a "clean up tool" documentation, but started getting dizzy reading all that script language etc. Not my cup of tea. Please help. Thank you for considering and reading this request. Kind regards M. Akil Walji

3 2

Debian, Postfix, Dovecot, MySQL, and argon2 password hashing scheme?
by David Mehler 25 Apr '24

25 Apr '24

Hello, I have a quick question. Can Debian, and/or it's Postfix/Dovecot/MySQL/MariaDB packages support the argon2 password hashing scheme? I had a previously-working e-mail setup on a *BSD system, utilizing the argon2ID scheme with Dovecot, Postfix, and MySQL. Since changing systems to Debian 12.5 I can't send, though checking the password with a manual login to Dovecot works fine. I'm wondering if I have to migrate the passwords from argon2ID to SHA512-CRYPT? Thanks. Dave. -- Sent from Mozilla Thunderbird 91.13.1

2 1

RE: Which DKIM application for postfix 3.9.0
by Joseph Tam 24 Apr '24

24 Apr '24

On Tue, Apr 23, 2024 at 7:33 AM <dovecot-request(a)dovecot.org> wrote: > > I am upgrading to postfix 3.9.0. I have not used DKIM in previous postfix installs, but I >> would like to start now with the new google rules. I have done some research and opendkim >> is the most recommended, however, other research states the opendkim has been >> abandoned by it's maintainers. So I am looking for a good alternative dkim software >> that will work with postfix that I can compile myself. I do not run on any linux >> version, so therefore I can not just apt-get a new dkim application. >> I run Solaris and therefore need to compile my applications, postfix and dkim. >> Any good suggestions will be appreciated. I just rolled out a locally compiled opendkim on my mail server. It works, but there are a few gotchas. Although it seems like a moribund project, there is a late beta version that includes some important patches, most notably the "Header:\n LongHeaderValue" bug that needs fixing. You can look at https://sourceforge.net/p/opendkim/patches/ to find that patch, as well as others you deem important. As DKIM standards are not going to change soon, having end-of-line software is not as bad as it seems unless you need particular enhancements to make it work better in your circumstances. Once you get your setup dialed, you can probably set it and forget it. Most of the headaches have actually been internal: local mail injection via sendmail would skip miltering, From header canonicalization by the MTA would not be seen by the opendkim milter thereby creating messages with missing or invalid signatures, and mailing list/auto reply/forwarder software mangling messages. I think Postfix does a better job in this regard, so these issues may not present itself. (I did a Postfix/opendkim milter on an Ubuntu system and it was much less hassle.) You should look at *lots* of DMARC RUA reports. People are doing crazy batsh*t stuff with your mail domain. Joseph Tam <jtam.home(a)gmail.com>

4 3

Setting compression to specific namespace
by Filip Bartmann 23 Apr '24

23 Apr '24

Hello, is it possible to set compression for specific namespace or spefic mailbox folder? Thanks, Filip Bartmann

1 0

Question about line length limit in lmtp.
by Kamil Jońca 22 Apr '24

22 Apr '24

I have postfix + dovecot server. Mail for local users are saved by dovecot lmtp. Recently I got some messages from postfix: --8<---------------cut here---------------start------------->8--- 4NQ07L4h4LztXXr: breaking line > 998 bytes with <CR><LF>SPAC --8<---------------cut here---------------end--------------->8--- This is because postfix has configured with default value lmtp_line_length_limit (990). I can turn off this limit (set to 0) but I am curious if dovecot lmtp will accept so lengthty lines? Does dovecot lmtp has any line limits? KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html

4 6

doveadm index to terminate non-zero in case of failure
by Jaco Kroon 22 Apr '24

22 Apr '24

Hi, It would be great if doveadm index could terminate non-zero in the case of index corruption, that way the tool can be used as a way to determine and remove corrupted indexes. Example: othala [13:56:24] ~ # doveadm index -u lumi_james INBOX doveadm(lumi_james): Error: Corrupted transaction log file /path/to/lumi_james/dovecot.list.index.log seq 2: Unexpected garbage at EOF (sync_offset=7168) doveadm(lumi_james): Error: Failed to map transaction log /path/to/lumi_james/dovecot.list.index.log at sync_offset=7168 after locking: Unexpected garbage at EOF othala [13:56:34] ~ # echo $? 0 othala [13:56:37] ~ # If doveadm index exited non-zero in above case we'd be able to: if ! doveadm index -u lumi_james INBOX; then rm /path/to/lumi_james/dovecot.index{,log,.cache} fi Which may be over-zealous in removing indexes, but we'd rather have that. We believe we already fixed the locking issue that caused the corrupt indexes and are busy cleaning them up based on log files, but it would still be great if the above could be integrated into our check battery if/when users report problems, of "run the script and it fixes 99% of things that are known to break". In the same breath, we're seeing that folders with & in the name are causing problems for doveadm index -u someuser '*' usage. Kind regards, Jaco

1 0

Variable expansion on %w
by Gandalf Corvotempesta 21 Apr '24

21 Apr '24

I'm following the guide for changing the password schema. Everything works as expected (i'm using a static passwd file), but when the plain password has a % inside, dovecot is trying to expand that, triggering an error: Apr 11 21:33:55 mail02 dovecot: pop3(x)<3962994><4soGPNcVXsoln9W6>: Error: Failed to expand plugin setting plain_pass = 'xxxxx%Yxxxxxx!%': Unknown variable '%Y' How can I block the variable expansion inside %w ?

3 10