help by recovering a mailbox - maildir and dovecot 2.2.13

2014-11-11 Thread Götz Reinicke - IT Koordinator
Hi,

an user screwd up his mailbox in such a way, that I dont see how to get
it back in the right order.

E.g. in the subcriptions file there is a folder

Studienjahr 2014 - 2015.Pitchings

in the filesystem there this folder is in trash and without spaces
between the years:

.Trash.Studienjahr 2014-2015.Pitchings

in the Filesystem ther is no folder

Studienjahr 2014-2015

Currently he uses our sogo as email client ant there are some folders to
showing up but some are empty, some cant be deleted ...


So any help and suggestion in recovering this structure is welcome!

Regards . Götz

-- 
Götz Reinicke
IT-Koordinator

Tel. +49 7141 969 82 420
E-Mail goetz.reini...@filmakademie.de

Filmakademie Baden-Württemberg GmbH
Akademiehof 10
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016

Vorsitzender des Aufsichtsrats: Jürgen Walter MdL
Staatssekretär im Ministerium für Wissenschaft,
Forschung und Kunst Baden-Württemberg

Geschäftsführer: Prof. Thomas Schadt



smime.p7s
Description: S/MIME Cryptographic Signature


Re: help by recovering a mailbox - maildir and dovecot 2.2.13

2014-11-11 Thread Steffen Kaiser

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, 11 Nov 2014, Götz Reinicke - IT Koordinator wrote:


an user screwd up his mailbox in such a way, that I dont see how to get
it back in the right order.

E.g. in the subcriptions file there is a folder

Studienjahr 2014 - 2015.Pitchings

in the filesystem there this folder is in trash and without spaces
between the years:

.Trash.Studienjahr 2014-2015.Pitchings

in the Filesystem ther is no folder

Studienjahr 2014-2015

Currently he uses our sogo as email client ant there are some folders to
showing up but some are empty, some cant be deleted ...


A client does not seem to synchronize subscription and folder operation. I 
would remove the subcriptions file und let the user subscribe anew.


If for instance subcriptions contains a mailbox, which does not exist 
physically, some versions of Thunderbird shows this mailbox, but as soon 
as you do something with it, you get a mailbox does not exist error. You 
can unsubscribe from the mailbox and the ghost mailboxes are gone.


- -- 
Steffen Kaiser

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBVGHVi3z1H7kL/d9rAQL3igf/acBloikzZxTdDtGS0dELadx5of/7Ei5a
hOjKn55XpJ7GY2gG0DAsyy4AgY8RPakcHozlPlfHSILke8iqg3gOJ8wYpbwiydXr
24mClQBd+WJMhwTBlFRgsL3/DYIMVZwJeCMPLt7Ho+u5/wjFZtsvj+Mx4j8IU3R6
ppKeYXe5E7wvW2BcJCxBAcpIL7hwQ5OCvkMC387C/5LG/BfRFgbR2yKwlFOpikOn
sH3CDcC2iZcqTcO2HWXt7Yu5nRRgklqVTiKzKZwDvfZYsHWWK1Ul7lufcsBPg9s+
EdDQni44H45+0G3P2dhtQsffm7/vYZqoQQ4N94MfpoPlIMOrU1bQPw==
=nqOd
-END PGP SIGNATURE-


Re: deliver an email to a large number of local users directly via doveadm

2014-11-11 Thread Steffen Kaiser

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Mon, 10 Nov 2014, Mahdi Mahdi wrote:

Hello,We have a mail service that uses postfix and dovecot. We would 
like to send an email to a large number of users(about 100K). However, 
it takes too long to send the email through smtp. Is there any solution 
to deliver the email locally to all user mailboxes directly.dovecot uses 
lmtp for transfering local emails. the worst solutoin is that copy the 
email to all mailboxes via linux file system. But we would prefer to use 
some tools provided by dovecot like doveadm. is there any way to do this 
job?


if your mail storage is Maildir and you use virtual users with the same 
uid/gid for all users, the filesystem level is easy going and circumvent 
Sieve:


1) sent the message to yourself,
2) move the message file somewhere, no user can access,
3) remove delivery headers,
4) rename the file, in order to not contain the :2,... stuff,
5) for u in *; do ln message_file /home/$u/Maildir/new; done

The for loop has to be altered to match your local requirements (path, 
users, ...) though.


=

Alternativly check out if Dovecot LDA works as expected and use it.

- -- 
Steffen Kaiser

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBVGHXMHz1H7kL/d9rAQKW8gf/Zslvd7JLfiWVtTQYqjoo4gWIY5KVYy3P
cxZCRswcFYoCtS0wmzi6kFqfYYZlvOz+Mak9FNM7SqbRNeGDhW9xHaWKc4SxTRE9
Rq8BGCltBNSgW/O4KPImF4S6jvlhVp433oOL70Q9zK7Pk5KOpA47YsHdosSwaZ+6
+buRPIoKOB/ktU4pnsCSrnGNuFw7EgME+pAJy98qjjJ2XKejZ0/fKxma4eaxxj5J
rfI71Gs4o3VIpJMdcYH3uBGkkn4/qCI4AqaHiZwnjoE7PwB8oipFbnQUdoHjFoMZ
eqsg/92eby97/w2+PwiR0mnQbU5H4Zt5Fx9cp7okeSWMBGRNb2dDUA==
=CFTS
-END PGP SIGNATURE-


Virtual User Authentication

2014-11-11 Thread Jerry
I have only virtual users on the system that I maintain. I am using Postfix
which is configured to use Devecot for authentication. I get several attempts
everyday to hack into the system, both via Postfix and directly via Dovecot.
The following is from the dovecot log:

Nov 11 04:14:48 auth-worker(21005): Error: pam(monica,69.193.88.146):
pam_authenticate() failed: authentication error (/etc/pam.d/dovecot missing?)

Now, I do not use pam on this system. Is there a way I can eliminate
Dovecot from trying to use it?

-- 
Jerry


pgpMBvuw7c8bs.pgp
Description: OpenPGP digital signature


Re: Virtual User Authentication

2014-11-11 Thread Steffen Kaiser

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, 11 Nov 2014, Jerry wrote:


Nov 11 04:14:48 auth-worker(21005): Error: pam(monica,69.193.88.146):
pam_authenticate() failed: authentication error (/etc/pam.d/dovecot missing?)

Now, I do not use pam on this system. Is there a way I can eliminate
Dovecot from trying to use it?


post your doveconf -n

- -- 
Steffen Kaiser

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBVGINdnz1H7kL/d9rAQIMRAf/Z6P6J0HLfhivcaEg6Y1RJI8s6TW735L7
5tRHv+XDNuwGVfMa0yge8XnTII4GoMeXkP99DJIOULF3lPfZ9sd2mr8JZmVjINQQ
togbwmoPkvEQ3b1SnNYNWXOwA35+Z4UeLgNIGxkZ+PJwbuoi4dZVl0QiQB0S8b1G
t32Z1bR2Hml/5r7S8rN9mZI2EpYPUhkG6cTxNK/zZw90NW0AtJ+RoKz8Mo+GhMff
NdVgGT9YD7m+79XE6WUwm2KFGBcmd6K4LFWBn5XorEI5YrPoktCUp1c+StM0TJNE
PRv8ATWN2zUPRIxrRtqRp7WCsEGQLRWxfW7sE+zrU5MggPXSKE2m4Q==
=JnBO
-END PGP SIGNATURE-


Re: Virtual User Authentication

2014-11-11 Thread Jerry
On Tue, 11 Nov 2014 14:21:58 +0100 (CET), Steffen Kaiser stated:

On Tue, 11 Nov 2014, Jerry wrote:

 Nov 11 04:14:48 auth-worker(21005): Error: pam(monica,69.193.88.146):
 pam_authenticate() failed: authentication error (/etc/pam.d/dovecot
 missing?)

 Now, I do not use pam on this system. Is there a way I can eliminate
 Dovecot from trying to use it?

post your doveconf -n

$ dovecot -n
# 2.2.15: /usr/local/etc/dovecot/dovecot.conf
# OS: FreeBSD 10.0-RELEASE-p12 amd64  ufs
auth_mechanisms = plain login cram-md5 digest-md5
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
log_path = /var/log/dovecot
mail_location = maildir:/var/mail/vmail/%d/gerard
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character 
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy 
include variables body enotify environment mailbox date ihave duplicate
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
special_use = \Drafts
  }
  mailbox Junk {
special_use = \Junk
  }
  mailbox Sent {
special_use = \Sent
  }
  mailbox Sent Messages {
special_use = \Sent
  }
  mailbox Trash {
special_use = \Trash
  }
  prefix = 
}
passdb {
  args = username_format=%u /usr/local/etc/dovecot/user/passwd
  driver = passwd-file
}
passdb {
  args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/user/passwd
  driver = passwd-file
}
passdb {
  driver = pam
}
passdb {
  args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/user/passwd
  driver = passwd-file
}
plugin {
  sieve_global_dir = /usr/local/etc/dovecot/sieve/
  sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve
}
postmaster_address = postmas...@seibercom.net
service auth {
  unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0666
user = postfix
  }
  unix_listener auth-userdb {
group = vmail
mode = 0666
user = vmail
  }
}
service imap-login {
  inet_listener imap {
port = 143
  }
  inet_listener imaps {
port = 993
ssl = yes
  }
}
service pop3-login {
  inet_listener pop3 {
port = 110
  }
  inet_listener pop3s {
port = 995
ssl = yes
  }
}
ssl_cert = /etc/ssl/certs/dovecot.pem
ssl_key = /etc/ssl/private/dovecot.pem
ssl_protocols = !SSLv2 !SSLv3
userdb {
  args = username_format=%u /usr/local/etc/dovecot/user/passwd
  default_fields = uid=vmail gid=vmail
  driver = passwd-file
}
userdb {
  driver = passwd
}
userdb {
  args = username_format=%u /usr/local/etc/dovecot/user/passwd
  driver = passwd-file
}
version_ignore = yes
protocol lda {
  mail_plugins = sieve sieve
}

-- 
Jerry


pgp_4x4DGvfG2.pgp
Description: OpenPGP digital signature


Re: Virtual User Authentication

2014-11-11 Thread Reindl Harald



Am 11.11.2014 um 15:41 schrieb Jerry:

On Tue, 11 Nov 2014 14:21:58 +0100 (CET), Steffen Kaiser stated:


On Tue, 11 Nov 2014, Jerry wrote:


Nov 11 04:14:48 auth-worker(21005): Error: pam(monica,69.193.88.146):
pam_authenticate() failed: authentication error (/etc/pam.d/dovecot
missing?)

Now, I do not use pam on this system. Is there a way I can eliminate
Dovecot from trying to use it?


post your doveconf -n


passdb {
   driver = pam
}


well, did you read the output?





signature.asc
Description: OpenPGP digital signature


Re: Virtual User Authentication

2014-11-11 Thread Jerry
On Tue, 11 Nov 2014 15:44:31 +0100, Reindl Harald stated:



Am 11.11.2014 um 15:41 schrieb Jerry:
 On Tue, 11 Nov 2014 14:21:58 +0100 (CET), Steffen Kaiser stated:

 On Tue, 11 Nov 2014, Jerry wrote:

 Nov 11 04:14:48 auth-worker(21005): Error: pam(monica,69.193.88.146):
 pam_authenticate() failed: authentication error (/etc/pam.d/dovecot
 missing?)

 Now, I do not use pam on this system. Is there a way I can eliminate
 Dovecot from trying to use it?

 post your doveconf -n

 passdb {
driver = pam
 }

well, did you read the output?

Yes I did. I created a dovecot.conf file and placed this in it:

#passdb {
#  driver = pam
#}

It didn't work. Dovecot has so many individual conf files that it is
difficult to figure out where everything is. I really like the Postfix method
where the last rule wins. I have not figured out in what file the pam
setting resides that is being picked up by Dovecot.

Personally, I am not a fan of this multiple file configuration scenario.

-- 
Jerry


pgpoR90IK_3Qd.pgp
Description: OpenPGP digital signature


Replication Advice Needed

2014-11-11 Thread Asai
I successfully set up Dovecot replication, having 2 servers syncing with 
each other.  While I had both servers in the same room on a Gigabit 
network, they were syncing fine.  But I took one to another location, 
and syncing was turned off for about 2 weeks.  Now I've turned both back 
on, they're sort of syncing, but not really.  The one remote server is 
not populating emails into various folders and it really should be 
cranking to sync those emails.


Do anyone have any insights on how we could troubleshoot this?

--
--Asai


Re: Virtual User Authentication

2014-11-11 Thread Christian Schmidt

On 11.11.2014 16:13, Jerry wrote:

Dovecot has so many individual conf files that it is
difficult to figure out where everything is. I really like the Postfix method
where the last rule wins.


It's just the same with dovecot.


I have not figured out in what file the pam
setting resides that is being picked up by Dovecot.


Give grep a chance.

Regards,
Christian

--
No signature available.


FTS-Solr: indexer-worker does not find mailbox

2014-11-11 Thread Marc Stürmer

Greetings,

I am running Dovecot v. 2.2.13 on a Gentoo Box. Mail users are virtual, 
data for them is stored in a MySQL-DB, Sieve is enabled and deliver is 
the LDA in conjunction with Postfix.


This setup has been running for a few years now without problems, the 
configuration works.


Some weeks ago the setup was still on a Ubuntu 12.04 LTS box, and 
Dovecot was v. 2.0.9. I've installed a Tomcat there with Solr and 
configured the FTS-Solr plugin from Dovecot. Worked like a charm without 
any problems at all.


Now the same setup on the Gentoo box does not work at all; either 
indexer-worker does not find the directory or is just indexing 0 messages.


Solr is also installed again (v. 3.6.0) on Tomcat, and Solr is running 
properly. I checked it with my browser and the logs, they are showing no 
errors.


gentoo ~ # dovecot --version
2.2.13

dovecot -n:
http://pastebin.com/NqLfrbp8

dovecot-sql.conf:
http://pastebin.com/KLf4pjJZ

Debug log.
Nov 11 20:12:14 kraftzwerg dovecot: indexer-worker: Debug: auth input: 
m...@marc-stuermer.de home=/var/kunden/mail/ 
mail=maildir:marc/m...@marc-stuermer.de/ uid=9997 gid=9997
Nov 11 20:12:14 kraftzwerg dovecot: indexer-worker: Debug: Added userdb 
setting: mail=maildir:marc/m...@marc-stuermer.de/
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Effective uid=9997, 
gid=9997, home=/var/kunden/mail/
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Namespace : type=private, 
prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes 
location=maildir:marc/m...@marc-stuermer.de/
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: maildir++: 
root=marc/m...@marc-stuermer.de, index=, indexpvt=, control=, 
inbox=marc/m...@marc-stuermer.de, alt=
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Namespace INBOX.: 
marc/m...@marc-stuermer.de doesn't exist yet, using default permissions
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Namespace INBOX.: Using 
permissions from marc/m...@marc-stuermer.de: mode=0700 gid=default
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Namespace : type=private, 
prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no 
location=fail::LAYOUT=none
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: none: root=, index=, 
indexpvt=, control=, inbox=, alt=
Nov 11 20:12:14 kraftzwerg dovecot: 
indexer-worker(m...@marc-stuermer.de): Debug: Syncing mailbox 
INBOX.gentoo failed: Mailbox doesn't exist: INBOX.gentoo
Nov 11 20:12:14 kraftzwerg dovecot: imap(m...@marc-stuermer.de): Error: 
indexer failed to index mailbox INBOX.gentoo


So the question is: where's the error and how to fix it? I am kinda 
clueless right now.


Thanks in advance,
Marc


Help with last_login plugin

2014-11-11 Thread Jorge Bastos
Hi,

 

I want to have a datetime column in my users table, to have the value
updated every time my users login via POP3/IMAP.

Last_login is new but I don't see any query example, or field names or so.

 

Does anyone can give an help on this?

 

Thanks,


Re: Help with last_login plugin

2014-11-11 Thread Pascal Volk
On 11/11/2014 08:55 PM, Jorge Bastos wrote:
 Hi,
 
  
 
 I want to have a datetime column in my users table, to have the value
 updated every time my users login via POP3/IMAP.
 
 Last_login is new but I don't see any query example, or field names or so.
 
  
 
 Does anyone can give an help on this?
 

This topic was discussed a few days ago. See
http://dovecot.org/list/dovecot/2014-October/098300.html


Regards,
Pascal
-- 
The trapper recommends today: cafefeed.1431...@localdomain.org


Re: Virtual User Authentication

2014-11-11 Thread Joseph Tam

Jerry je...@seibercom.net writes:


Personally, I am not a fan of this multiple file configuration scenario.


Then don't use it.  Concatenate all the included files together and
throw out the settings you don't need.  My (single) config file is
~340 lines, 2/3 of which are comments.

Joseph am jtam.h...@gmail.com


Query: SELECT INBOX permission denied

2014-11-11 Thread Don Levey
Yesterday I was forced to migrate servers due to a hardware failure.  I
have been able to bring up my mail server, and set up Squirrelmail and
Dovecot.  I am able to access (via Squirrelmail) all users' mail except
one - which happens to be my wife's, so it would be really helpful if I
could get that working too.  I am able to log in, but see the following
message in the main pane:

   ERROR: Could not complete request.
   Query: SELECT INBOX
   Reason Given: [NOPERM] Permission denied

I have see similar errors in my searches, but they all relate to
*creating* files (inbox, sent, etc).  The files do already exist here,
they used to work in the same directory structure on the old server
configuration, and I can see no relative difference between this user's
files/permissions and working users' files/permissions.

Suggestions are welcome; thanks in advance,
 -Don

Here are the vitals:

Version: 2.2.10
OS: CentOS 7

# 2.2.10: /etc/dovecot/dovecot.conf
# OS: Linux 3.10.0-123.9.3.el7.x86_64 x86_64 CentOS Linux release 7.0.1406
(Core)  ext3
auth_mechanisms = plain login
disable_plaintext_auth = no
log_path = /var/log/dovecot.log
mail_location = mbox:/home/%u/~mail:INBOX=/var/spool/mail/%u
mbox_write_locks = fcntl
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
special_use = \Drafts
  }
  mailbox Junk {
special_use = \Junk
  }
  mailbox Sent {
special_use = \Sent
  }
  mailbox Sent Messages {
special_use = \Sent
  }
  mailbox Trash {
special_use = \Trash
  }
  prefix =
}
passdb {
  driver = pam
}
ssl = required
ssl_cert = /etc/pki/dovecot/certs/dovecot.pem
ssl_key = /etc/pki/dovecot/private/dovecot.pem
userdb {
  driver = passwd
}


[root@dungeon sandra]# ls -la /var/spool/mail
total 2097152
drwxrwxr-x.  2 root mail   4096 Nov 11 22:10 .
drwxr-xr-x. 16 root root   4096 Nov 11 14:21 ..
-rw-rw.  1 sandra   mail  625547161 Nov 11 21:32 sandra
-rw-rw.  1 spamtrap_000 mail   26773946 Nov 11 20:53 spamtrap_000
-rw-rw.  1 spamtrap_001 mail3092961 Nov 11 22:10 spamtrap_001
-rw-rw.  1 spamtrap_002 mail8778257 Nov 11 00:03 spamtrap_002
-rw-rw.  1 spamtrap_003 mail   63579856 Nov 11 21:21 spamtrap_003

Her directory:
[root@dungeon .imap]# ls -la
total 100
drw---. 25 sandra sandra 4096 Jul  1  2008 .
drwx--.  4 sandra sandra 4096 Nov 10 10:48 ..
drwx--.  2 sandra sandra 4096 Jul  1  2008 bday
drwx--.  2 sandra sandra 4096 Jul  1  2008 beads
drwx--.  2 sandra sandra 4096 Jul  1  2008 books
drwx--.  2 sandra sandra 4096 Jul  1  2008 Drafts
drwx--.  2 sandra sandra 4096 Jul  1  2008 ham
drwx--.  2 sandra sandra 4096 Nov 11 21:39 INBOX
drwx--.  2 sandra sandra 4096 Jul  1  2008 Sent
drwx--.  2 sandra sandra 4096 Jul  1  2008 spam
drwx--.  2 sandra sandra 4096 Jul  1  2008 Trash
drwx--.  2 sandra sandra 4096 Jul  1  2008 Work

A working directory:
[root@dungeon .imap]# ls -la
total 56
drwx--. 14 spamtrap_003 spamtrap_003 4096 Oct 23 19:22 .
drwx--.  3 spamtrap_003 spamtrap_003 4096 Nov 10 09:15 ..
drwx--.  2 spamtrap_003 spamtrap_003 4096 Jun  8 08:40 Deleted Messages
drwx--.  2 spamtrap_003 spamtrap_003 4096 Aug 11  2011 Drafts
drwx--.  2 spamtrap_003 spamtrap_003 4096 Mar 18  2011 ham
drwx--.  2 spamtrap_003 spamtrap_003 4096 Nov 11 21:21 INBOX
drwx--.  2 spamtrap_003 spamtrap_003 4096 Oct 18  2013 Sent
drwx--.  2 spamtrap_003 spamtrap_003 4096 Aug 28 09:55 Sent Messages
drwx--.  2 spamtrap_003 spamtrap_003 4096 Oct  6 20:11 spam
drwx--.  2 spamtrap_003 spamtrap_003 4096 Nov 11 21:21 Trash


New director features

2014-11-11 Thread Timo Sirainen
I implemented a couple of larger director changes today. These could still be 
changed a bit if somebody has any ideas.

http://hg.dovecot.org/dovecot-2.2/rev/b9df3d654710

Support for director tags, which allow creating multiple Dovecot backend 
groups using a single director ring. So you can mark different backend hosts 
with @tag names and then have passdb lookup return the wanted tag for each 
user. Note that because director works using user hashes, two users with the 
same hash can't be in different backend groups. Use doveadm director map -u 
user@domain to see which hash is used by the user@domain.

http://hg.dovecot.org/dovecot-2.2/rev/b9df3d654710

Added director_consistent_hashing=yes setting so users don't move around much 
when backend servers are added/removed. Ideally at some point this setting will 
be removed and directors will automatically switch to it when all the directors 
in the ring support it.


Re: Disabling SSLv3 protocol

2014-11-11 Thread Timo Sirainen
On 09 Nov 2014, at 08:22, Jelmer Vernooij jel...@debian.org wrote:

 On Tue, Oct 14, 2014 at 12:25:32PM -0700, Timo Sirainen wrote:
 Since people are now talking about the SSLv3 security hole and how to 
 disable it, here's a thread where you can talk about that. In Dovecot v2.1+ 
 you can disable SSLv3 by setting:
 
 ssl_protocols = !SSLv2 !SSLv3
 
 In older versions you'd have to patch the source code. Attached a patch 
 against v2.0. 
 Do you have any plans to make this (SSLv3 disabled) the new default for
 ssl_protocols? I'm considering doing this in the Debian package.

Yeah, I'm planning to do it for Dovecot v2.3 at least. I'm not sure if I should 
change it to v2.2.x. I guess I could, because apparently there aren't any 
commonly used clients that support only SSLv3. But then again I don't think 
SSLv3 is especially exploitable with IMAP/POP3 protocols.


Re: Query: SELECT INBOX permission denied

2014-11-11 Thread Steffen Kaiser

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, 12 Nov 2014, Don Levey wrote:


Yesterday I was forced to migrate servers due to a hardware failure.  I
have been able to bring up my mail server, and set up Squirrelmail and
Dovecot.  I am able to access (via Squirrelmail) all users' mail except
one - which happens to be my wife's, so it would be really helpful if I
could get that working too.  I am able to log in, but see the following
message in the main pane:

  ERROR: Could not complete request.
  Query: SELECT INBOX
  Reason Given: [NOPERM] Permission denied


Post the logs from Dovecot, too.


I have see similar errors in my searches, but they all relate to
*creating* files (inbox, sent, etc).  The files do already exist here,
they used to work in the same directory structure on the old server
configuration, and I can see no relative difference between this user's
files/permissions and working users' files/permissions.

Suggestions are welcome; thanks in advance,
-Don

Here are the vitals:

Version: 2.2.10
OS: CentOS 7

# 2.2.10: /etc/dovecot/dovecot.conf
# OS: Linux 3.10.0-123.9.3.el7.x86_64 x86_64 CentOS Linux release 7.0.1406
(Core)  ext3
auth_mechanisms = plain login
disable_plaintext_auth = no
log_path = /var/log/dovecot.log
mail_location = mbox:/home/%u/~mail:INBOX=/var/spool/mail/%u
mbox_write_locks = fcntl
namespace inbox {
 inbox = yes
 location =
 mailbox Drafts {
   special_use = \Drafts
 }
 mailbox Junk {
   special_use = \Junk
 }
 mailbox Sent {
   special_use = \Sent
 }
 mailbox Sent Messages {
   special_use = \Sent
 }
 mailbox Trash {
   special_use = \Trash
 }
 prefix =
}
passdb {
 driver = pam
}
ssl = required
ssl_cert = /etc/pki/dovecot/certs/dovecot.pem
ssl_key = /etc/pki/dovecot/private/dovecot.pem
userdb {
 driver = passwd
}


[root@dungeon sandra]# ls -la /var/spool/mail
total 2097152
drwxrwxr-x.  2 root mail   4096 Nov 11 22:10 .
drwxr-xr-x. 16 root root   4096 Nov 11 14:21 ..
-rw-rw.  1 sandra   mail  625547161 Nov 11 21:32 sandra
-rw-rw.  1 spamtrap_000 mail   26773946 Nov 11 20:53 spamtrap_000
-rw-rw.  1 spamtrap_001 mail3092961 Nov 11 22:10 spamtrap_001
-rw-rw.  1 spamtrap_002 mail8778257 Nov 11 00:03 spamtrap_002
-rw-rw.  1 spamtrap_003 mail   63579856 Nov 11 21:21 spamtrap_003

Her directory:
[root@dungeon .imap]# ls -la
total 100
drw---. 25 sandra sandra 4096 Jul  1  2008 .
drwx--.  4 sandra sandra 4096 Nov 10 10:48 ..
drwx--.  2 sandra sandra 4096 Jul  1  2008 bday
drwx--.  2 sandra sandra 4096 Jul  1  2008 beads
drwx--.  2 sandra sandra 4096 Jul  1  2008 books
drwx--.  2 sandra sandra 4096 Jul  1  2008 Drafts
drwx--.  2 sandra sandra 4096 Jul  1  2008 ham
drwx--.  2 sandra sandra 4096 Nov 11 21:39 INBOX
drwx--.  2 sandra sandra 4096 Jul  1  2008 Sent
drwx--.  2 sandra sandra 4096 Jul  1  2008 spam
drwx--.  2 sandra sandra 4096 Jul  1  2008 Trash
drwx--.  2 sandra sandra 4096 Jul  1  2008 Work

A working directory:
[root@dungeon .imap]# ls -la
total 56
drwx--. 14 spamtrap_003 spamtrap_003 4096 Oct 23 19:22 .
drwx--.  3 spamtrap_003 spamtrap_003 4096 Nov 10 09:15 ..
drwx--.  2 spamtrap_003 spamtrap_003 4096 Jun  8 08:40 Deleted Messages
drwx--.  2 spamtrap_003 spamtrap_003 4096 Aug 11  2011 Drafts
drwx--.  2 spamtrap_003 spamtrap_003 4096 Mar 18  2011 ham
drwx--.  2 spamtrap_003 spamtrap_003 4096 Nov 11 21:21 INBOX
drwx--.  2 spamtrap_003 spamtrap_003 4096 Oct 18  2013 Sent
drwx--.  2 spamtrap_003 spamtrap_003 4096 Aug 28 09:55 Sent Messages
drwx--.  2 spamtrap_003 spamtrap_003 4096 Oct  6 20:11 spam
drwx--.  2 spamtrap_003 spamtrap_003 4096 Nov 11 21:21 Trash



- -- 
Steffen Kaiser

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBVGL8H3z1H7kL/d9rAQLVSggAsAzg0Qsiyw1Y97gIw3FyGrLLn2PYQd30
9yzHBw60r5CYbUKrWDm4GwMy5HTfFqfGlz0OQ+QaXIm960a8NNGUmkUlHCXoQdTf
R1k1BX8RVSlFGcm1pQkUuZEOvjUy0kIjOh4vU48iWiZJD0fRSLE8zIPbRQcff9x+
MU/+NvgJ2iGXSPlAnT5XKiT++l7k6i4LpDvcGFPXd4Q/fXXMyabpTuZTLjGnqtCu
vXqAGsBsSgXt5jsgJsB5bfO/fZh8llcNMAlrFFdcLtJAYrY6FvQIEPU5tUFqXQTS
O54/K9KcyjelFU1zGoIiqRylojZrtV/GHi1ZKRyFBRpwOI9Cr0XAeQ==
=TP5S
-END PGP SIGNATURE-


Re: Disabling SSLv3 protocol

2014-11-11 Thread A. Schulze


Timo Sirainen:


... I don't think SSLv3 is especially exploitable with IMAP/POP3 protocols.


It's well known SSLv3 *is* a problem for HTTP, we assume, it isn't for  
SMTP/POP/IMAP


Administrators, also responsible for putting new paper in the printer,  
may not have the skill to distinguish in that detail. They see the  
panic in HTTP and see no action on other Application. What do they  
learn?


On the other side:
If we consequently disable the broken protocol they /may/ see
Ah, SSLv3 REALLY seem to be broken, the experts disable it here and  
there and over there, too


The attention is much higher.

Andreas