Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 04:11, schrieb Stan Hoeppner: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 05:24, Professa Dementia wrote: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 05:24, schrieb Professa Dementia: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 09:26, Robert Schetterer wrote: Am 03.07.2013 04:11, schrieb Stan Hoeppner: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 03:27, Timo Sirainen wrote: On 3.7.2013, at 4.21, John Fawcett john...@erba.tv wrote: dnsbl's are a popular method to prevent listed ips from making connections to mta software. cf. postscreen_dnsbl_sites in postfix Would it be possible to introduce such a feature in dovecot,

[Dovecot] Who all accessed my dovecot server?

2013-07-03 Thread pvsuja
Hi, I have set up a mail server with dovecot as IMAP/POP3 server, postfix as MTA and roundcube as web mail client. Other mail clients such as Thunderbird is also being used for mail access. Now as a security policy in our organization, I want to know the IP addresses of the machines from which

Re: [Dovecot] lmtp: Disable Delivered-To header

2013-07-03 Thread Micha Krause
Hi, using LMTP, is it possible to disable the addition of the Delivered-To header to messages? No. But why? Stupid customer, I migrated his Mailbox from Cyrus to Dovecot, and now this Delivered-To: Header is somehow shown as To: in his Client. I tried to Explain it to him, but he demands

Re: [Dovecot] Who all accessed my dovecot server?

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 10:32, schrieb pvsuja: Hi, I have set up a mail server with dovecot as IMAP/POP3 server, postfix as MTA and roundcube as web mail client. Other mail clients such as Thunderbird is also being used for mail access. Now as a security policy in our organization, I want to know

Re: [Dovecot] Who all accessed my dovecot server?

2013-07-03 Thread Frerich Raabe
Am 7/3/2013 10:32 AM, schrieb pvsuja: I have set up a mail server with dovecot as IMAP/POP3 server, postfix as MTA and roundcube as web mail client. Other mail clients such as Thunderbird is also being used for mail access. Now as a security policy in our organization, I want to know the IP

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Branko Majic
On Wed, 03 Jul 2013 09:37:14 +0200 Robert Schetterer r...@sys4.de wrote: Am 03.07.2013 05:24, schrieb Professa Dementia: On 7/2/2013 7:11 PM, Stan Hoeppner wrote: On 7/2/2013 8:32 PM, Professa Dementia wrote: On 7/2/2013 6:21 PM, John Fawcett wrote: dnsbl's are a popular method to

Re: [Dovecot] Who all accessed my dovecot server?

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 10:53, schrieb Frerich Raabe: Am 7/3/2013 10:32 AM, schrieb pvsuja: I have set up a mail server with dovecot as IMAP/POP3 server, postfix as MTA and roundcube as web mail client. Other mail clients such as Thunderbird is also being used for mail access. Now as a security

Re: [Dovecot] lmtp: Disable Delivered-To header

2013-07-03 Thread Robert Schetterer
Am 03.07.2013 10:43, schrieb Micha Krause: Hi, using LMTP, is it possible to disable the addition of the Delivered-To header to messages? No. But why? Stupid customer, I migrated his Mailbox from Cyrus to Dovecot, and now this Delivered-To: Header is somehow shown as To: in his Client.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Professa Dementia
On 7/3/2013 12:35 AM, John Fawcett wrote: The point is to stop spambot connections to pop and imap (which are usually done to try and steal credentials). This is not the usual way spambots work. Generally, spambots scrape addresses from various sources in order to get lists of emails to send

Re: [Dovecot] namespace delivery question

2013-07-03 Thread Laszlo Kiraly
Thanks Steffen, It mostly works. my public namespace config: -- namespace { type = public prefix = public/ separator = / location = sdbox:/home/vmail/public/ list = no subscriptions = no } -- If I rewrite i...@domain.com to

Re: [Dovecot] namespace delivery question

2013-07-03 Thread Steffen Kaiser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 3 Jul 2013, Laszlo Kiraly wrote: It mostly works. location = sdbox:/home/vmail/public/ If I rewrite i...@domain.com to vmail+public/i...@domain.com, then it saved to /home/vmail/public/mailboxes/info however if I get mail to

Re: [Dovecot] namespace delivery question

2013-07-03 Thread Laszlo Kiraly
If I rewrite i...@domain.com to vmail+public/i...@domain.com, then it saved to /home/vmail/public/mailboxes/info however if I get mail to vmail+public/i...@anotherdomain.com then it's saved to the same mailbox. How can I set dovecot to save to different mailboxes? if both users

[Dovecot] tcpwrappers

2013-07-03 Thread lejeczek
hi everybody having I believe sort of plain-vanilla config with section in 10-tcpwrapper.conf as per docs login_access_sockets = tcpwrap service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } /etc/hosts.deny

[Dovecot] Creating an authenticated user master user

2013-07-03 Thread Chris Bullock
dovecot --version 1.1.18 mbox format We are trying to migrate from dovecot to another imap server and need some help migrating the user data to the new server. We have written a perl script to migrate the data but it seems that we need an authenticated or Master user in order for the script to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done -- senders that put my email into body content will deliver it to my own trashcan, so if you like to

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
Timo Sirainen skrev den 2013-07-03 03:27: You're talking about IMAP/POP3 connections? Possible, yeah .. possibly even without code changes by using tcpwrappers. why is it needed ? setup fail2ban to manange xtables-addons geoip csv files from abusers, then use this csv file as A0 list in

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 09:40: Possible, yeah .. possibly even without code changes by using tcpwrappers. TImo, thanks for the reply. I will look into that suggestion. John if its implemented in dovecot possible use postfix memcached ?, so thay share cache data -- senders that

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 18:44, Benny Pedersen wrote: Timo Sirainen skrev den 2013-07-03 03:27: You're talking about IMAP/POP3 connections? Possible, yeah .. possibly even without code changes by using tcpwrappers. why is it needed ? setup fail2ban to manange xtables-addons geoip csv files from

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 18:40, Benny Pedersen wrote: John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done in this case no, I am talking about connections from zombies.

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Benny Pedersen
John Fawcett skrev den 2013-07-03 20:41: in this case no, I am talking about connections from zombies. block client ip of the zombies, this is what iptables is for, or change rules to only have ports open for clients location, well dovecot supports ipblocking, but imho its not the right

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Reindl Harald
Am 03.07.2013 20:41, schrieb John Fawcett: On 03/07/13 18:40, Benny Pedersen wrote: John Fawcett skrev den 2013-07-03 03:21: dnsbl's are a popular method to prevent listed ips from making connections to mta software. hmm are pop3/imap clients not authed users ? well done in this case

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread John Fawcett
On 03/07/13 12:47, Professa Dementia wrote: On 7/3/2013 12:35 AM, John Fawcett wrote: The point is to stop spambot connections to pop and imap (which are usually done to try and steal credentials). This is not the usual way spambots work. Generally, spambots scrape addresses from various

[Dovecot] Released Pigeonhole v0.4.1 for Dovecot v2.2.4.

2013-07-03 Thread Stephan Bosch
Hello Dovecot users, Now that I am not preoccupied anymore, I quickly release a new version of Pigeonhole for Dovecot v2.2. This consists mainly of bug fixes. One new feature is that the Sieve plugin will try to pass temporary failures (e.g. from mail storage) back to LDA/LMTP as much as

[Dovecot] login_trusted_networks from webmail ?

2013-07-03 Thread Jan-Frode Myklebust
I'd like to get the IP-address of the webmail-klient logged in my maillog (for being compliant with coming data retention policies). I've noticed that with login_trusted_networks pointing at my dovecot directors, we get rip=client-ip logged on the backends. How is the proxy providing this to the

Re: [Dovecot] login_trusted_networks from webmail ?

2013-07-03 Thread Timo Sirainen
On 3.7.2013, at 23.29, Jan-Frode Myklebust janfr...@tanso.net wrote: I'd like to get the IP-address of the webmail-klient logged in my maillog (for being compliant with coming data retention policies). I've noticed that with login_trusted_networks pointing at my dovecot directors, we get

Re: [Dovecot] login_trusted_networks from webmail ?

2013-07-03 Thread Jan-Frode Myklebust
On Wed, Jul 03, 2013 at 11:34:56PM +0300, Timo Sirainen wrote: a ID (x-originating-ip 1.2.3.4) Perfect, thanks! Feature request for SOGo filed: http://www.sogo.nu/bugs/view.php?id=2366 -jf

Re: [Dovecot] login_trusted_networks from webmail ?

2013-07-03 Thread Timo Sirainen
On 3.7.2013, at 23.50, Jan-Frode Myklebust janfr...@tanso.net wrote: On Wed, Jul 03, 2013 at 11:34:56PM +0300, Timo Sirainen wrote: a ID (x-originating-ip 1.2.3.4) Perfect, thanks! Feature request for SOGo filed: http://www.sogo.nu/bugs/view.php?id=2366 Oh and BTW the reason it

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Joseph Tam
Professa Dementia writes: 2) Fail2Ban with rules that seem like they are pretty weak, but trust me, they work fine and you limit complaints from users. a) If you get 3 invalid login attempts within a minute from more than 1 IP address, block that login for 10 minutes. If you have blocked a

Re: [Dovecot] dnsbl feature for dovecot

2013-07-03 Thread Professa Dementia
On 7/3/2013 2:30 PM, Joseph Tam wrote: Brute force attempts are more intense, so I think these rules can be set harder to not risk plunking your users into blacklist hell. Also, some common role account (that don't exist on my system e.g. admin) will trigger an immediate blacklist here -- an

Re: [Dovecot] flat file in tmpfs for dict quota

2013-07-03 Thread Ken A
On 7/2/2013 8:48 AM, Steffen Kaiser wrote: On Thu, 27 Jun 2013, Ken A wrote: I'm using dict quota like so: quota = dict:User quota::file:/[path]/quotas/%u [path]/quotas/ is a tmpfs. The idea is to do less work on disk. Other than forcing dovecot to rebuild quotas on a reboot, are

Re: [Dovecot] flat file in tmpfs for dict quota

2013-07-03 Thread Timo Sirainen
On 27.6.2013, at 19.44, Ken A k...@pacific.net wrote: I'm using dict quota like so: quota = dict:User quota::file:/[path]/quotas/%u [path]/quotas/ is a tmpfs. The idea is to do less work on disk. There are no fsync() or fdatasync() calls to quota files. Ideally if the system had

[Dovecot] CaCert certificate configuration help needed

2013-07-03 Thread gw1500se
I was not able to find specific help for configuring the crt file for CaCert. I gleaned from examples the following order: server certificate CaCert class 3 certificate Cacert root certificate However, when I try to configure my mail reading for IMAP, Dovecot shows the following error in the