subject:"Re\: server migration"

Re: server migration

2024-04-10 Thread Gandalf Corvotempesta via dovecot

in my case, 99% of mailboxes are imap

Il gio 11 apr 2024, 00:08 Michael Peddemors via dovecot 
ha scritto:
 Of course, anyone who is stilling using POP (Leave on Server)
 presents a
 different challenge.. Depending on the client, and how the client
 treated the UID of the message..

 The rest should present no issue..

 On 2024-04-10 14:25, Kirill Miazine via dovecot wrote:
 >
 >
 > • Gandalf Corvotempesta via dovecot [2024-04-10 23:18]:
 >> Il giorno mer 10 apr 2024 alle ore 23:12 Kirill Miazine via
 dovecot
 >>  ha scritto:
 >>> UIDVALIDITY change
 >>
 >> In which case uidvalidity would change ?
 >
 > if you do rsync, it doesn't. UIDVALIDITY is stored in dovecot-
 uidlist in
 > maildirs, as described in
 > https://doc.dovecot.org/admin_manual/mailbox_formats/maildir/#imap-
 uid-mapping
 > ___
 > dovecot mailing list -- dovecot@dovecot.org
 > To unsubscribe send an email to dovecot-le...@dovecot.org


 --
 "Catch the Magic of Linux..."
 -
 ---
 Michael Peddemors, President/CEO LinuxMagic Inc.
 Visit us at http://www.linuxmagic.com @linuxmagic
 A Wizard IT Company - For More Info http://www.wizard.ca
 "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd.
 -
 ---
 604-682-0300 Beautiful British Columbia, Canada

 ___
 dovecot mailing list -- dovecot@dovecot.org
 To unsubscribe send an email to dovecot-le...@dovecot.org
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Michael Peddemors via dovecot

Of course, anyone who is stilling using POP (Leave on Server) presents a 
different challenge.. Depending on the client, and how the client 
treated the UID of the message..


The rest should present no issue..

On 2024-04-10 14:25, Kirill Miazine via dovecot wrote:



• Gandalf Corvotempesta via dovecot [2024-04-10 23:18]:

Il giorno mer 10 apr 2024 alle ore 23:12 Kirill Miazine via dovecot
 ha scritto:

UIDVALIDITY change


In which case uidvalidity would change ?


if you do rsync, it doesn't. UIDVALIDITY is stored in dovecot-uidlist in 
maildirs, as described in 
https://doc.dovecot.org/admin_manual/mailbox_formats/maildir/#imap-uid-mapping

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org



--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Kirill Miazine via dovecot




• Gandalf Corvotempesta via dovecot [2024-04-10 23:18]:

Il giorno mer 10 apr 2024 alle ore 23:12 Kirill Miazine via dovecot
 ha scritto:

UIDVALIDITY change


In which case uidvalidity would change ?


if you do rsync, it doesn't. UIDVALIDITY is stored in dovecot-uidlist in 
maildirs, as described in 
https://doc.dovecot.org/admin_manual/mailbox_formats/maildir/#imap-uid-mapping

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Gandalf Corvotempesta via dovecot

Il giorno mer 10 apr 2024 alle ore 23:12 Kirill Miazine via dovecot
 ha scritto:
> UIDVALIDITY change

In which case uidvalidity would change ?
Manually changes in config file ?
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Kirill Miazine via dovecot




• Gandalf Corvotempesta via dovecot [2024-04-10 22:59]:

What could trigger a new re-download of message ?


UIDVALIDITY change
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Gandalf Corvotempesta via dovecot

Il giorno mer 10 apr 2024 alle ore 22:32 Marc via dovecot
 ha scritto:
> Why? The whole idea about having a LTS distribution is that you almost never 
> need to do this? It is not like the imap/pop/smtp standards are having yearly 
> innovations. Or is this a service you provide for clients?

In my case the server migration has to be done because the old
datacenter is closing and i have to move all datas to a new server on
a different location.
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Gandalf Corvotempesta via dovecot

Il giorno mer 10 apr 2024 alle ore 21:40 Kirill Miazine via dovecot
 ha scritto:
> What you describe is exactly what I have been doing since ... forever
>
> - reduce TTL
> - setup new server
> - rsync
> - stop ALL mail services on old server (also anything which might be
> doing deliveries, this is important), kill client connections, if any
> - rsync again
> - update DNS
> - start mail service on new server
> - verify
> - increase TTL

this is what i've planned, but I have to be 1% sure that clients
wont re-download all messages again.
What could trigger a new re-download of message ?
The new server would be able to handle the mails stored with the old
hostname and at the same time handle
the mails stored with the new hostname (and thus different file name)
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Christopher Wensink via dovecot


Can you expand and explain this:

Why? The whole idea about having a LTS distribution is that you almost never 
need to do this?

Can you provide a link for context?

On 4/10/2024 3:25 PM, Marc via dovecot wrote:



• Gandalf Corvotempesta via dovecot [2024-04-10 21:07]:

Guys, any help?

What you describe is exactly what I have been doing since ... forever


Why? The whole idea about having a LTS distribution is that you almost never 
need to do this? It is not like the imap/pop/smtp standards are having yearly 
innovations. Or is this a service you provide for clients?
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org



--
Christopher Wensink
IS Administrator
Five Star Plastics, Inc
1339 Continental Drive
Eau Claire, WI 54701
Office:  715-831-1682
Mobile:  715-563-3112
Fax:  715-831-6075
cwens...@five-star-plastics.com
www.five-star-plastics.com

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

RE: server migration

2024-04-10 Thread Marc via dovecot

> 
> 
> 
> • Gandalf Corvotempesta via dovecot [2024-04-10 21:07]:
> > Guys, any help?
> 
> What you describe is exactly what I have been doing since ... forever
> 

Why? The whole idea about having a LTS distribution is that you almost never 
need to do this? It is not like the imap/pop/smtp standards are having yearly 
innovations. Or is this a service you provide for clients?
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

RE: server migration

2024-04-10 Thread Marc via dovecot

> 
> Guys, any help?

this lacks context. 

> Also, what would happen if the new server has a different hostname ?

So put temporary haproxy infront of it?

> Il giorno dom 10 mar 2024 alle ore 14:28 Gandalf Corvotempesta
>  ha scritto:
> >
> > Hi guys
> > I have to migrate around 10k mailboxes from dovecot 2.13 to (i think)
> > the same version but on a different server.

Why not just mount the data on the other server?

> > I have to reduce as much as possible the inconveniences to the users,
> > at least in this (temporary) phase.

Just prepare two vm configs and stop the old and start the new.

> > What do you suggest to move everything ? Same config, same maildir
> > location and rsync everything ?

You have to have a good reason to change storage formats, it is not really 
related to what instagrammers reeling about. What is your good reason to change?

> > Better ideas ? i've thought to use the exact same config on both
> > servers, then start multiple rsync to sync as much as possible and
> > when ready, drop the old dovecot in the old server, rsync the latest
> > changes, and then move the dns pointment from the old ip to the new
> > one.

I would go for just mount the data images on the other server. If that is not 
possible and you don't seem to know what is on the other server. Do the doveadm 
sync.

I would suggest thinking a bit more about this and what you want in the future. 
Because you don't want to do this to often. There was just a discussion about 
these folder names what you might consider looking at. Als the availability of 
2.4, maybe wait?

> > But what about the MUA downloading emails ? I think this would be
> > safe...or there is a chance that some MUA would re-download everything
> > ? This would be unacceptable.
> >

You will see when you are testing. 



___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Kirill Miazine via dovecot




• Gandalf Corvotempesta via dovecot [2024-04-10 21:07]:

Guys, any help?


What you describe is exactly what I have been doing since ... forever

- reduce TTL
- setup new server
- rsync
- stop ALL mail services on old server (also anything which might be 
doing deliveries, this is important), kill client connections, if any

- rsync again
- update DNS
- start mail service on new server
- verify
- increase TTL

You mention multiple rsyncs, I wouldn't bother...


Also, what would happen if the new server has a different hostname ?


You'd get new filenames in Maildir, and this is it.


Il giorno dom 10 mar 2024 alle ore 14:28 Gandalf Corvotempesta
 ha scritto:


Hi guys
I have to migrate around 10k mailboxes from dovecot 2.13 to (i think)
the same version but on a different server.

I have to reduce as much as possible the inconveniences to the users,
at least in this (temporary) phase.

What do you suggest to move everything ? Same config, same maildir
location and rsync everything ?

Better ideas ? i've thought to use the exact same config on both
servers, then start multiple rsync to sync as much as possible and
when ready, drop the old dovecot in the old server, rsync the latest
changes, and then move the dns pointment from the old ip to the new
one.

But what about the MUA downloading emails ? I think this would be
safe...or there is a chance that some MUA would re-download everything
? This would be unacceptable.

thank you

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: server migration

2024-04-10 Thread Gandalf Corvotempesta via dovecot

Guys, any help?
Also, what would happen if the new server has a different hostname ?

Il giorno dom 10 mar 2024 alle ore 14:28 Gandalf Corvotempesta
 ha scritto:
>
> Hi guys
> I have to migrate around 10k mailboxes from dovecot 2.13 to (i think)
> the same version but on a different server.
>
> I have to reduce as much as possible the inconveniences to the users,
> at least in this (temporary) phase.
>
> What do you suggest to move everything ? Same config, same maildir
> location and rsync everything ?
>
> Better ideas ? i've thought to use the exact same config on both
> servers, then start multiple rsync to sync as much as possible and
> when ready, drop the old dovecot in the old server, rsync the latest
> changes, and then move the dns pointment from the old ip to the new
> one.
>
> But what about the MUA downloading emails ? I think this would be
> safe...or there is a chance that some MUA would re-download everything
> ? This would be unacceptable.
>
> thank you
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?

2023-06-24 Thread Robert Lister




Should work then if you have roundcube 1.6.x and php8.2 which is also 
the

bookworm package version.

Depends on your server spec / number of users if you use argon2 over 
bcrypt.


One approach might be to just migrate all users to BLF-CRYPT anyway, and 
then
set the recommended dovecot member settings and selectively change a few 
users
to ARGON2ID to see the impact.  If you stored both hashes in the 
database, this

would allow you to switch back.

If someone gained  write access to the database somehow, they could 
possibly

replace user's password hash with a new one, thereby allowing them
to gain access to user accounts.

Two-factor authentication of course is the way to go with roundcube,
but by default, there's nothing stopping access using the same 
credentials

via IMAP/Submission without the 2FA, so roundcube 2FA isn't effective by
itself if users also have access to IMAP/Submission.

I improved things a bit by using roundcube plugins:-

mmvi/twofactor_webauthn   -  FIDO2/webauthn 2FA.

And: https://github.com/openSUSE/ap4rc

I modified it a bit to allow using the same username and added some
features to it:  https://github.com/listerr/ap4rc/tree/last-access

Ultimately the goal is to eliminate passwords using OAUTH2 etc but not 
quite

there yet.

R.




On 2023-06-24 14:54, David Mehler wrote:

Hello,

Thanks. The other utility I would be using is the Roundcube webmail
password plugin.  Still trying to figure the best option.

More opinions?
Thanks.
Dave.



--
Robert Lister  - email:  r...@lentil.org  - tel: 020 7043 7996
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?

2023-06-24 Thread David Mehler

Hello,

Thanks. The other utility I would be using is the Roundcube webmail
password plugin.  Still trying to figure the best option.

More opinions?
Thanks.
Dave.


On 6/24/23, Robert Lister  wrote:
>
> I did a similar upgrade, and now in the process of migrating from
> SHA512-CRYPT
> to BLF-CRYPT with an appropriately set rounds, as I think the default
> rounds
> is a little low.
>
> A good write-up on migrating passwords and calculating the rounds:
> https://kaworu.ch/blog/2016/04/20/strong-crypt-scheme-with-dovecot-postfixadmin-and-roundcube/
>
>
> I would take into consideration the following factors when deciding the
> hashing algo.
>
> 1. Other tools/scripts that need to update or check passwords in the
> database,
> for example:
> - roundcube webmail has a plugin to allow users to change their
> password
>   using a variety of methods.
> - postfixadmin
>
> For a long time, bcrypt wasn't natively supported by either the
> version of php
> or underlying OS libs, so these tools had to rely on calling "doveadm
> pw "
> to generate BLF-CRYPT hashes. And assumed that doveadm was available
> on the same server as it.
>
> The latest versions support bcrypt and newer hashing algos natively.
>
> Some tools might rely on the database (mysql/mariadb) to hash
> passwords, so
> this may also be a consideration.
>
> 2. Server load / libs:
>
> - The Dovecot docs:
> https://doc.dovecot.org/configuration_manual/authentication/password_schemes/
>   has this to say on ARGON2I/ARGON2ID:
>
>   "Argon2 is the winner of password hashing competition held at July
> 2015. The password will
>start with $argon2i$ or $argon2id$. You can use -r to tune
> computational complexity,
>minimum is 3. ARGON2ID is only available if your libsodium is
> recent enough.
>ARGON2 can require quite a hefty amount of virtual memory, so we
> recommend that you set
>service auth { vsz_limit = 2G } at least, or more."
>
> There's a good write up of considering the various algos:
>
> https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
>
> I considered BLF-CRYPT (for the time being) to be strong enough and a
> good balance between compatibility, strength and server load, given the
> number of users etc.
>
> Rob
>
>
> On 2023-06-23 02:14, David Mehler wrote:
>> Hello,
>>
>> I'm migrating to a new server. It's running Debian 11 currently though
>> that's going 12 this weekend. Currently it uses Openssl v3.0.9, and
>> dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user
>> account information v10.6.14. My question is in regards password
>> storage and scheme/encryption/salts.
>>
>> Currently they are stored in Mariadb password field with a type of
>> varchar and a 255 character length, and are stored as SHA512-CRYPT.
>> I'm wondering if I should keep this as is or when I migrate go to
>> another scheme? I'm thinking argon2i, argon2d, argon2id, sha512,
>> sha512-crypt, tiger2, saltt?
>
>
> --
> Robert Lister  - email:  r...@lentil.org  - tel: 020 7043 7996
> ___
> dovecot mailing list -- dovecot@dovecot.org
> To unsubscribe send an email to dovecot-le...@dovecot.org
>
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

Re: Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?

2023-06-24 Thread Robert Lister

I did a similar upgrade, and now in the process of migrating from
SHA512-CRYPT
to BLF-CRYPT with an appropriately set rounds, as I think the default
rounds

is a little low.

A good write-up on migrating passwords and calculating the rounds:
https://kaworu.ch/blog/2016/04/20/strong-crypt-scheme-with-dovecot-postfixadmin-and-roundcube/

I would take into consideration the following factors when deciding the
hashing algo.

1. Other tools/scripts that need to update or check passwords in the
database,

for example:
- roundcube webmail has a plugin to allow users to change their
password

using a variety of methods.
- postfixadmin

For a long time, bcrypt wasn't natively supported by either the
version of php
or underlying OS libs, so these tools had to rely on calling "doveadm
pw "

to generate BLF-CRYPT hashes. And assumed that doveadm was available
on the same server as it.

The latest versions support bcrypt and newer hashing algos natively.

Some tools might rely on the database (mysql/mariadb) to hash
passwords, so

this may also be a consideration.

2. Server load / libs:

- The Dovecot docs:
https://doc.dovecot.org/configuration_manual/authentication/password_schemes/

has this to say on ARGON2I/ARGON2ID:

"Argon2 is the winner of password hashing competition held at July
2015. The password will
start with $argon2i$ or $argon2id$. You can use -r to tune
computational complexity,
minimum is 3. ARGON2ID is only available if your libsodium is
recent enough.
ARGON2 can require quite a hefty amount of virtual memory, so we
recommend that you set

service auth { vsz_limit = 2G } at least, or more."

There's a good write up of considering the various algos:

https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

I considered BLF-CRYPT (for the time being) to be strong enough and a
good balance between compatibility, strength and server load, given the
number of users etc.

Rob

On 2023-06-23 02:14, David Mehler wrote:

Hello,

I'm migrating to a new server. It's running Debian 11 currently though
that's going 12 this weekend. Currently it uses Openssl v3.0.9, and
dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user
account information v10.6.14. My question is in regards password
storage and scheme/encryption/salts.

Currently they are stored in Mariadb password field with a type of
varchar and a 255 character length, and are stored as SHA512-CRYPT.
I'm wondering if I should keep this as is or when I migrate go to
another scheme? I'm thinking argon2i, argon2d, argon2id, sha512,
sha512-crypt, tiger2, saltt?

--
Robert Lister - email: r...@lentil.org - tel: 020 7043 7996
___
dovecot mailing list -- dovecot@dovecot.org
To unsubscribe send an email to dovecot-le...@dovecot.org

40 matches

Mail list logo