April 2024 - dovecot - dovecot.org

Dovecot somehow creating new local e-mails from a compromised account
by Greg Earle 12 Apr '24

12 Apr '24

Hello all, long-time listener, first-time caller ... I returned from an Eclipse trip to find a couple of sp*m e-mails in an account. I checked the logs and there was no Postfix activity during the delivery times. The 2 spams have basically no headers in them. I went back to the logs and instead found Dovecot IMAP server activity during those times. Apparently Russian hax0rs (hostnames stat_list.ip-ptr.tech and service_stat.ip-ptr.tech) compromised an account and logged into it via IMAP, and somehow were able to create these two sp*m e-mails on my system. Obviously I've changed the account password but I would really like to know how they were able to create e-mails on my system when ostensibly I would have assumed they could only read the account's e-mails via IMAP. If it matters it's an older version of Dovecot on Fedora with a fairly heavily customized set of .conf files. I ran "doveconf -a" but didn't see anything obvious in the output. I may enable rawlogs in case they come knocking again, even though the password has been changed. Thanks.

4 3

Re: Message Age Deletion Query
by Steve Hadachek 11 Apr '24

11 Apr '24

Thanks Lucas! I'll give these a try. On Wednesday, April 10, 2024 at 11:31:42 PM PDT, Lucas Rolff <lucas(a)lucasrolff.com> wrote: https://doc.dovecot.org/3.0/man/doveadm-search-query.7/ Probably something like savedbefore 4weeksOr even sentbefore 4weeks Sent from Outlook for iOSFrom: Steve Hadachek via dovecot <dovecot(a)dovecot.org> Sent: Thursday, April 11, 2024 10:03:22 AM To: dovecot(a)dovecot.org <dovecot(a)dovecot.org> Subject: Message Age Deletion Query Hello. Using Mochahost and want to delete mailbox items older than 1 month (approx) from receipt . Reading DoveCot documentation, not finding age query. Can you please specify this for me and provide an example? Thank you and Kind Regards, -Steve Hadachek Thanks Lucas! I'll give these a try. On Wednesday, April 10, 2024 at 11:31:42 PM PDT, Lucas Rolff <lucas(a)lucasrolff.com> wrote: https://doc.dovecot.org/3.0/man/doveadm-search-query.7/ Probably something like savedbefore 4weeks Or even sentbefore 4weeks Sent from Outlook_for_iOS =============================================================================== From: Steve Hadachek via dovecot <dovecot(a)dovecot.org> Sent: Thursday, April 11, 2024 10:03:22 AM To: dovecot(a)dovecot.org <dovecot(a)dovecot.org> Subject: Message Age Deletion Query Hello. Using Mochahost and want to delete mailbox items older than 1 month (approx) from receipt . Reading DoveCot documentation, not finding age query. Can you please specify this for me and provide an example? Thank you and Kind Regards, -Steve Hadachek

1 0

maybe list rocky and centos9 stream?
by Marc 11 Apr '24

11 Apr '24

maybe list rocky and centos9 stream on the repo page? https://repo.dovecot.org/

3 3

imap/pop proxy
by Gandalf Corvotempesta 11 Apr '24

11 Apr '24

Hi all first time user as dovecot imap/pop3 proxy. As i'm migrating some mailboxes to a new server, i would like to move a couple at once, not everything (more than 10k). The quickest way would be to setup the current (and old) dovecot server as pop3/imap server AND proxy. I'm thinking to start returning proxy_maybe in the password DB query, pointing to the mailbox server. If the mailbox server is migrated to the new one, proxy_maybe will point to the remote server, if the mailbox is still on the old server, proxy_maybe will point to localhost. Is this enough ? Password auth should be done on the "remote" server and not by the proxy itself. Ideas ?

1 0

Strange problem with sieve
by Peter 11 Apr '24

11 Apr '24

Hello, I use Dovecot 2.3.20 on FreeBSD 13.2 (in jail) as a part of iRedMail installation. Some mailboxes are configured for automatic mails processing using sieve (execute :pipe) and a custom binary (started by script). The system was configured and was working correctly during several weeks. Since ~10 days the system starts to work strangely. _*/Some/*_ mails cannot be decoded anymore. No changes at our side, no updates etc. I dumped the content received by my binary, and it looks really strange: pOUc9Z33O0GbfzbW5Mrmi 3L4tTlvKfsD8wP+hc6vN1v1bv+Vx827kW+YX5n/Zxtl240erH4t+nNyeuL1zh92O0p24nYKd vbtcd1UVyBdkFwztDtrdsIexJ2/Pu71L914vnFdYto+0T7JvoCiwqGm/7v6d+78UJxf3lHiU 1B9QO7D1wIeD3IO3S91K68rUy/LLPv/E/6m/3Le8oUK/ovAQ7lDWoaeHow63/8z8ubpStTK/ This is a start of one mail. No headers, no readable data. I removed "discard;" from sieve script to put such mails in the mailbox, and the mails look normally: Mime-Version:1.0 Content-Type:multipart/mixed; boundary="=-/3n/zeVGlN5thgeL28RKiw==" --=-/3n/zeVGlN5thgeL28RKiw== Content-Type: multipart/alternative; boundary="=-sE/MdvfJZlakBmrKkcdzCg==" --=-sE/MdvfJZlakBmrKkcdzCg== Content-Type: multipart/related; boundary="=-cgJVnLNlzX5YuD6yaI5USQ==" --=-cgJVnLNlzX5YuD6yaI5USQ== Content-Transfer-Encoding: base64 Content-Type: text/html; charset=utf-8 etc. Really, I have no idea about any direction to explore. The server is totally under my control, I can do anything, but I have no idea how to debug this situation. I tried to redirect such mails to another mailbox and process them there, but I get the same strange data. If I connect Thunderbird to the mailbox - I can read the mails correctly. So, the problem arrives at the moment when the sieve system is invoked - the mail data is corrupted somehow. Any advise will be really appreciated. Peter Hello, I use Dovecot 2.3.20 on FreeBSD 13.2 (in jail) as a part of iRedMail installation. Some mailboxes are configured for automatic mails processing using sieve (execute :pipe) and a custom binary (started by script). The system was configured and was working correctly during several weeks. Since ~10 days the system starts to work strangely. Some mails cannot be decoded anymore. No changes at our side, no updates etc. I dumped the content received by my binary, and it looks really strange: pOUc9Z33O0GbfzbW5Mrmi 3L4tTlvKfsD8wP+hc6vN1v1bv+Vx827kW+YX5n/Zxtl240erH4t+nNyeuL1zh92O0p24nYKd vbtcd1UVyBdkFwztDtrdsIexJ2/Pu71L914vnFdYto+0T7JvoCiwqGm/7v6d+78UJxf3lHiU 1B9QO7D1wIeD3IO3S91K68rUy/LLPv/E/6m/3Le8oUK/ovAQ7lDWoaeHow63/8z8ubpStTK/ This is a start of one mail. No headers, no readable data. I removed "discard;" from sieve script to put such mails in the mailbox, and the mails look normally: Mime-Version:1.0 Content-Type:multipart/mixed; boundary="=-/3n/zeVGlN5thgeL28RKiw==" --=-/3n/zeVGlN5thgeL28RKiw== Content-Type: multipart/alternative; boundary="=-sE/MdvfJZlakBmrKkcdzCg==" --=-sE/MdvfJZlakBmrKkcdzCg== Content-Type: multipart/related; boundary="=-cgJVnLNlzX5YuD6yaI5USQ==" --=-cgJVnLNlzX5YuD6yaI5USQ== Content-Transfer-Encoding: base64 Content-Type: text/html; charset=utf-8 etc. Really, I have no idea about any direction to explore. The server is totally under my control, I can do anything, but I have no idea how to debug this situation. I tried to redirect such mails to another mailbox and process them there, but I get the same strange data. If I connect Thunderbird to the mailbox - I can read the mails correctly. So, the problem arrives at the moment when the sieve system is invoked - the mail data is corrupted somehow. Any advise will be really appreciated. Peter

2 4

Message Age Deletion Query
by Steve Hadachek 11 Apr '24

11 Apr '24

Hello. Using Mochahost and want to delete mailbox items older than 1 month (approx) from receipt . Reading DoveCot documentation, not finding age query. Can you please specify this for me and provide an example? Thank you and Kind Regards, -Steve Hadachek Hello. Using Mochahost and want to delete mailbox items older than 1 month (approx) from receipt . Reading DoveCot documentation, not finding age query. Can you please specify this for me and provide an example? Thank you and Kind Regards, -Steve Hadachek

2 1

Re: server migration
by Gandalf Corvotempesta 11 Apr '24

11 Apr '24

Guys, any help? Also, what would happen if the new server has a different hostname ? Il giorno dom 10 mar 2024 alle ore 14:28 Gandalf Corvotempesta <gandalf.corvotempesta(a)gmail.com> ha scritto: > > Hi guys > I have to migrate around 10k mailboxes from dovecot 2.13 to (i think) > the same version but on a different server. > > I have to reduce as much as possible the inconveniences to the users, > at least in this (temporary) phase. > > What do you suggest to move everything ? Same config, same maildir > location and rsync everything ? > > Better ideas ? i've thought to use the exact same config on both > servers, then start multiple rsync to sync as much as possible and > when ready, drop the old dovecot in the old server, rsync the latest > changes, and then move the dns pointment from the old ip to the new > one. > > But what about the MUA downloading emails ? I think this would be > safe...or there is a chance that some MUA would re-download everything > ? This would be unacceptable. > > thank you

5 11

Users with enough rope to hang themselves
by Rupert Gallagher 10 Apr '24

10 Apr '24

Hello, I keep finding myself in a corner with a user. He uses mail extensively, which is fine, he has a huge archive of own professional correspondence, which is fine, but he uses mail folders as if they were regular system folders, with very long paths, and keeps renaming them and moving them around, daily, breaking the mail index and ultimately wasting his own time looking around for lost mail. His Inbox holds a gargantuan of subfolders, causing both the client and the server to overwork each time he opens the mail. His Archive is a maze of subfolders with repeating names. I advised him almost daily across 20 year on how to stay organised, but he keeps abusing the service. I want to help him by limiting what he can do with folders. This is the agenda: 1. the Archive is the only place where he can create folders; 2. folder names have a maximum length of 20 characters. Can I do that with Dovecot? Hello, I keep finding myself in a corner with a user. He uses mail extensively, which is fine, he has a huge archive of own professional correspondence, which is fine, but he uses mail folders as if they were regular system folders, with very long paths, and keeps renaming them and moving them around, daily, breaking the mail index and ultimately wasting his own time looking around for lost mail. His Inbox holds a gargantuan of subfolders, causing both the client and the server to overwork each time he opens the mail. His Archive is a maze of subfolders with repeating names. I advised him almost daily across 20 year on how to stay organised, but he keeps abusing the service. I want to help him by limiting what he can do with folders. This is the agenda: 1. the Archive is the only place where he can create folders; 2. folder names have a maximum length of 20 characters. Can I do that with Dovecot?

2 3

error: no member named 'st_ctim' in 'struct stat'
by Lasse Törngren 09 Apr '24

09 Apr '24

Hello James, I get the exact same error when trying to compile Dovecot 2.3.21 on both Mac OS Monterey 12.7.3 and Mac OS Ventura 13.6.4. dbox-storage.c:296:32:error:no member named 'st_atim' in 'struct stat' last_temp_file_scan = stats.st_atim.tv_sec; ~~~~~ ^ dbox-storage.c:297:24:error:no member named 'st_ctim' in 'struct stat' change_time = stats.st_ctim.tv_sec; Dovecot 2.3.20 compiles without any issue. Did you ever understand how to solve the problem? Best regards Lasse Törngren Hello James, I get the exact same error when trying to compile Dovecot 2.3.21 on both Mac OS Monterey 12.7.3 and Mac OS Ventura 13.6.4. dbox-storage.c:296:32:error:no member named 'st_atim' in 'struct stat' last_temp_file_scan = stats.st_atim.tv_sec; ~~~~~ ^ dbox-storage.c:297:24:error:no member named 'st_ctim' in 'struct stat' change_time = stats.st_ctim.tv_sec; Dovecot 2.3.20 compiles without any issue. Did you ever understand how to solve the problem? Best regards Lasse Törngren

1 0

doveadm sync - I/O has stalled
by songliny 09 Apr '24

09 Apr '24

Hi All, We are using dovecot 2.3.19.1 We created a account with more than 1000 mail folders in Maildir format to reproduce the issue. After weeks of testing, we have found a logic that may cause dsync to encounter the error - no activity for 900 seconds.... The function, dsync_ibc_stream_input, is the callback function after some data are ready for be read. This is part of what it does. o_stream_cork(ibc->output); ibc->ibc.io_callback(ibc->ibc.io_context); o_stream_uncork(ibc->output); Normally, ibc->ibc.io_callback(ibc->ibc.io_context) reads some data and then processes it. But when dsync connects over tcps, it uses function implementations in lib-ssl-iostream to send and receive data. And this simplified call stack would result in some data are read when calling o_stream_uncork o_stream_uncork => o_stream_flush => o_stream_ssl_flush_buffer => openssl_iostream_bio_sync => openssl_iostream_bio_input If some data arrive after ibc->ibc.io_callback(ibc->ibc.io_context) and before o_stre am_uncork, o_stream_uncork would read the data and then return. After o_stream_uncork returns, dsync then waits for new data to be read or written. But because the data had been read in o_stream_uncork, and there may be no new data to be read, dsync may then wait until timeout is met. It may happen, but it is hard to reproduce. If you also encounter this situation, you may try to use dsync over tcp connection. It does not read data when calling o_stream_uncork. As a result, it may not stuck. Back to the error itself, Maybe openssl-stream should not read data when doing uncork(flush)? Song-Lin Yang

2 4